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(RTO  EN-14) 


Executive  Summary 

Aging  aircraft  concerns  have  dramatically  escalated  during  recent  years.  Due  to  NATO’s  changing 
role,  which  includes  peace  keeping  missions  remote  from  home  bases,  the  requirement  of  unimpaired 
high  operational  capacity,  higher  utilization  of  its  air  fleets  and  budgetary  constraints,  prospects  are  for 
aging  aircraft  problems  to  continue  to  become  more  acute.  Airworthiness  concerns  have  preoccupied 
authorities  wrestling  with  the  aging  aircraft  issue.  However,  the  NATO  nations  are  having  to  contend 
with  another  dimension  which  could  not  at  all  have  been  anticipated  even  some  years  ago,  viz.,  severe 
budgetary  constraints  have  necessitated  retention  of  aircraft  designed  decades  ago  for  much  longer, 
meaning  that  the  performance  of  such  aircraft  have  to  satisfy  fast-changing  mission  needs,  which 
might  be  considerably  beyond  their  original  design  basis.  On  account  of  the  currency  and  interest  in 
the  subject  a  Lecture  Series  on  Aging  Aircraft  is  proposed. 

A  Lecture  Series  (LS-206)  titled  “Aging  Combat  Aircraft  Fleets  -  Long  Term  Implications,”  under  the 
sponsorship  of  AGARD  was  offered  in  1996.  Due  to  the  immediacy  of  structural  airworthiness 
concerns,  LS-206  largely  dealt  with  issues  pertaining  to  forms  of  structural  degradation  in  aging 
aircraft.  Also,  due  to  the  vast  scope  of  concerns  relating  to  the  airframe  in  an  aging  aircraft,  the 
coverage  of  the  previously  offered  LS  virtually  excluded  other  structures  and  subsystems.  For  instance, 
it  did  not  address  any  aspect  of  aging  helicopters  -  a  major  component  of  the  defense  force  of  the 
NATO  alliance.  The  LS  was  even  devoid  of  guidance  as  to  how  to  deal  with  other  critical  subsystems 
in  aging  airplanes  such  as  avionics  and  electrical  related  subsystems  and  aircraft  engines.  Yet  a  recent 
study  indicates,  for  instance,  that  the  power  plant  and  ancillary  components  account  for  some  30%  of 
the  life-cycle-cost  of  an  aircraft.  One  of  the  principal  aims  of  the  proposed  LS  is  to  highlight  schemes 
for  retrofitting  major  subsystems,  other  than  the  airframe,  in  aging  aircraft.  Performance  enhancement 
of  subsystems  to  counter  their  technological  obsolescence  will  be  the  major  theme  of  the  proposed  LS. 

The  material  in  this  publication  was  assembled  to  support  a  Lecture  Series  under  the  sponsorship  of  the 
Applied  Vehicle  Technology  Panel  (AVT)  and  the  Consultant  and  Exchange  Programme  of  RTO 
presented  on  23-24  October  2000  in  Atlantic  City,  USA  and  on  26-27  October  2000  in  Madrid,  Spain. 
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Synthese 

Le  probleme  des  aeronefs  vieillissants  s’est  considerablement  amplifie  ces  dernieres  annees.  Etant 
donne  Involution  du  role  de  l’OTAN,  qui  comprend  desormais  des  missions  de  maintien  de  la  paix  a 
distance  des  bases  d’attache,  la  necessite  d’une  grande  disponibilite  operationnelle,  et  l’utilisation 
croissante  des  flottes  aeriennes  dans  une  periode  de  contraintes  budgetaires,  il  est  fort  probable  que  ce 
probleme  s’accentue  a  l’avenir.  La  question  de  F aptitude  au  vol  preoccupe  les  autorites  qui  cherchent 
une  solution  au  probleme  des  aeronefs  vieillissants.  Toutefois,  les  pays  membres  de  l’OTAN  doivent 
aujourd’hui  faire  face  a  un  autre  aspect  du  probleme,  qui  ne  pouvait  etre  anticipe  il  y  a  quelques 
annees:  d’importantes  restrictions  budgetaires  necessitant  le  maintien  pour  encore  quelques  temps 
d’appareils  congus  il  y  a  des  dizaines  d’ annees,  les  performances  de  ces  demiers  doivent  repondre  a 
revolution  rapide  de  la  nature  de  la  mission,  laquelle  pourrait  largement  depasser  le  cadre  de  sa 
conception  initiale.  L’actualite  du  sujet  et  l’interet  qui  lui  est  porte  conduisent  a  proposer  un  cycle  de 
conferences  sur  les  aeronefs  vieillisants. 

Un  cycle  de  conferences  (LS-206),  intitule  «  Le  vieillissement  des  flottes  d’avions  de  combat  - 
Implications  a  long  terme  »  et  organise  sous  l’egide  d’AGARD,  a  ete  propose  en  1996.  Du  fait  de 
l’urgence  des  preoccupations  d’aptitude  au  vol  du  point  de  vue  structural,  le  cycle  de  conferences  a 
essentiellement  traite  de  points  relatifs  aux  types  de  degradation  structurelle  d’ aeronefs  vieillissants. 
De  meme,  etant  donne  le  grand  nombre  de  questions  que  souleve  la  cellule  d’un  appareil  vieillissant, 
les  autres  structures  et  sous-systemes  n’ont  pratiquement  pas  ete  abordes  par  le  cycle  de  conferences 
precedent.  Ainsi,  le  cycle  n’a  evoque  aucun  aspect  relatif  aux  helicopteres  vieillissants,  composante 
majeure  de  la  force  de  defense  de  F Alliance.  Il  n’a  pas  non  plus  fourni  de  ligne  directrice  permettant 
de  gerer  d’ autres  sous-systemes  essentiels  sur  les  aeronefs  vieillissants  comme  F  avionique,  les  sous- 
systemes  electriques  et  les  moteurs.  Pourtant,  une  etude  recente  a  montre  a  titre  d’exemple  que  le 
groupe  propulseur  et  les  elements  annexes  represented  environ  30%  du  cout  global  de  possession  d’un 
aeronef.  L’un  des  principaux  objectifs  du  cycle  de  conferences  propose  est  de  mettre  en  evidence  les 
programmes  de  rattrapage  des  sous-systemes  majeurs  (autres  que  la  cellule)  sur  les  appareils 
vieillissants.  L’accroissement  des  performances  des  sous-systemes  visant  a  pallier  leur  obsolescence 
technologique  constituera  le  theme  majeur  du  cycle  de  conferences  propose. 

Cette  publication  a  ete  redigee  pour  servir  de  support  de  cours  pour  le  Cycle  de  conferences  218, 
organise  par  la  Commission  des  technologies  appliquees  aux  vehicules  (AVT)  dans  le  cadre  du 
programme  des  consultants  et  des  echanges  de  la  RTO  du  23-24  octobre  2000,  a  Atlantic  City,  Etats- 
Unis,  et  du  26-27  octobre  2000  a  Madrid,  Espagne. 
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Theme 


Aging  Aircraft  concerns  have  dramatically  escalated  in  the  military  community  and  commercial  aviation  during 
the  past  decade.  The  percentage  of  aircraft,  operated  beyond  their  original  design  life  is  steadily  increasing. 
Some  models,  which  have  already  been  in  service  for  more  than  40  years,  will  need  to  be  retained  for  another 
two  decades  or  longer,  often  serving  in  roles  and  in  theaters  very  different  from  what  was  envisioned  when  they 
were  originally  designed. 

Aging  Aircraft  has  several  connotations.  To  name  a  few:  technological  obsolescence,  the  specter  of  runaway 
maintenance  costs,  and  safety.  However,  the  adverse  impact  on  sustainment  of  the  fleet  is  the  common  thread. 

There  are  other  considerations  when  dealing  with  the  Aging  Aircraft  issue;  for  example,  spare  parts,  processes 
and  tooling  may  no  longer  be  available,  logistic  procedures  may  have  changed  and  suppliers  may  be  out  of  the 
business.  Budgetary  limitations  and  higher  fleet  utilization  will  increase  the  demand  to  cope  with  aging 
structures  and  major  subsystems  like  engines  and  avionics.  Heightening  the  awareness  in  the  user  community 
about  typical  challenges  and  technical  solutions  to  ameliorate  some  of  the  concerns  is  the  purpose  of  this  Lecture 
Series. 


Theme 


Le  probleme  du  vieillissement  des  aeronefs  s’est  considerablement  amplifie  pour  les  exploitants  militaires  et 
commerciaux  au  cours  de  la  derniere  decennie.  Le  pourcentage  d’ aeronefs  en  exploitation  au-dela  de  leur  duree 
de  vie  theorique  augmente  regulierement.  Certains  modeles,  deja  en  service  depuis  plus  de  40  ans,  devront  etre 
maintenus  pendant  encore  deux  decennies  au  moins,  souvent  pour  des  missions  et  des  theatres  tres  differents  de 
ceux  qui  etaient  envisages  a  l’origine. 

Le  terme  “aeronefs  vieillissants”  a  plusieurs  connotations  differentes,  parmi  lesquelles  l’on  peut  distinguer 
V  obsolescence  technologique,  le  spectre  des  couts  de  maintenance  incontroles  et  les  considerations  de  securite. 
Mais,  tous  ces  aspects  ont  un  facteur  commun:  l’impact  negatif  sur  le  maintien  de  la  flotte. 

II  y  a  aussi  d’autres  considerations  a  prendre  en  compte;  par  exemple  la  disponibilite  de  pieces  de  rechange,  de 
processus  et  d’outillage,  les  procedures  logistiques  qui  peuvent  avoir  change,  et  les  fournisseurs  qui  peuvent 
avoir  fait  faillite.  Les  limitations  budgetaires  et  Tutilisation  accrue  des  flottes  aeriennes  necessiteront  de  porter 
plus  d’ attention  aux  aspects  de  vieillissement  de  la  structure  et  des  sous-systemes  principaux  des  aeronefs,  tels 
que  les  moteurs  et  l’avionique.  Ce  cycle  de  conferences  a  pour  objectif  de  promouvoir  une  meilleure 
sensibilisation  des  utilisateurs  aux  defis  et  aux  solutions  techniques  typiques  susceptibles  de  pallier  a  certains  de 
ces  problemes. 
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J85  REJUVENATION  THROUGH  TECHNOLOGY  INSERTION 

T.A.  Brisken,  P.N.  Howell,  A.C.  Ewing 

Military  Engines  Operation 
GE  Aircraft  Engines 
1  Neumann  Way 
Cincinnati,  OH  45215,  USA 


Summary 

The  history  of  the  General  Electric  J85 
turbojet  engine  is  presented  from  its  early  inception 
as  a  single-use  drone  engine  to  its  equipping  of 
almost  3,000  frontline  fighter  and  attack  aircraft. 
The  technology  development  to  enable  this 
progression  and  provide  support  of  over  7,000  in- 
service  engines  is  further  discussed,  allowing  its 
continued  use  for  the  next  40  years.  Specific 
examples  of  technology  insertion  are  detailed, 
including  a  discussion  of  the  innovative  program 
leading  to  upgrade  of  the  J85-powered  T-38  fleet 
and  options  for  the  rest  of  the  world’s  air  forces. 

Keywords 

J85,  CJ610,  CF700,  T-38,  F-5,  PMP, 
turbojet,  compressor,  spooled  rotor,  Inconel,  ejector 

Initial  J85  Development 

In  the  early  1950s,  General  Electric  (GE) 
began  design  work  on  a  series  of  very  small,  high 


thrust  to  weight  ratio  turbojet  engines  with  potential 
application  to  early  cruise  missiles  and  drones. 
Initially  using  a  compressor  with  only  seven  stages, 
a  configuration  using  eight  stages  was  finally 
settled  on  to  provide  for  adequate  performance 
margin,  which  proved  to  be  prophetic.  These  design 
efforts  resulted  in  the  J85-GE-1  engine,  and  at 
1,900-2,100  lbs.  of  dry  thrust  powered  the 
GAM-72/ADM-20  Quail  decoy  missile  (Figure  1) 
deployed  on  USAF  B-52  bombers.  Besides  needing 
high  thrust  in  a  lightweight  package,  most  other 
requirements  were  fairly  benign.  A  reasonable 
airstart  envelope  was  specified  due  to  its  being  an 
air-launched  missile,  and  a  30-minute,  one-way 
mission  life  was  all  that  was  needed. 


Figure  1:  McDonnell  Douglas  ADM-20 
(GAM-72)  Quail 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “Aging  Engines,  Avionics ,  Subsystems  and  Helicopters", 
held  in  Atlantic  City,  USA,  23-24  October  2000;  Madrid,  Spain,  26-22  October  2000,  and  published  in  RTO  EN-14. 
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The  high  thrust  to  weight  ratio,  small  size, 
and  good  fuel  economy  brought  the  engine  to  the 
attention  of  aircraft  designers  at  Northrop.  These 
designers  were  in  the  process  of  digesting  the 
lessons  of  the  air  war  in  Korea,  where  high  speed, 
high  ceiling,  maneuverability,  and  long  range  were 
all  at  a  premium.  Northrop  was  also  analyzing  the 
results  of  a  survey  they  conducted  with  users 
around  the  world,  which  drove  Northrop  towards 
development  of  a  high-performance  lightweight 
fighter  (World  Airpower  Journal,  Vol.  25,  Summer 
1996). 

The  J85  goes  Manned  and  Reusable 

By  1954,  Northrop’s  aircraft  studies  in 
lightweight  fighters  and  associated  trainers  centered 
on  using  the  J85  (Scutts,  1986).  Their  N-156  series 
of  designs  utilized  two  of  the  engines  in  an 
afterburning  configuration  to  achieve  the  necessary 
maximum  speed  and  maneuvering  capability.  It  was 
at  this  point  that  the  humble  beginnings  of  the  J85 
as  a  missile  engine  began  to  raise  problems. 

Selected  by  the  USAF  to  build  a  supersonic 
jet  trainer,  Northrop’s  N-156T  design  became  the 
YT-38  Talon.  This  selection  was  dependent  on 
successful  flight  testing  of  prototype  aircraft 
powered  by  J85  engines  (Scutts).  However,  design 
work  was  necessary  to  increase  the  dry  thrust  of  the 
engine,  increase  its  service  life,  and  adapt  it  to 
withstand  the  effects  of  the  afterburner,  not  to 
mention  a  greatly  expanded  flight  envelope. 
Pending  the  results  of  these  efforts,  however,  the 
decision  was  made  to  install  modified,  non- 
afterburning  J85-GE-1  engines  in  the  first  prototype 
T-38.  April  10,  1959  marked  the  first  flight  of  the 
J85  as  the  primary  powerplant  of  a  manned  aircraft, 
successfully  reaching  0.9M  and  a  height  of  35,000 
feet,  achieving  supersonic  flight  in  a  shallow  dive 
only  a  few  days  later  (Scutts).  The  second  prototype 
was  also  outfitted  in  this  manner. 


Figure  2:  Northrop  T-38A 

Following  successful  development,  the 
definitive  afterburning  version  of  the  J85  for  T-38 
aircraft  (Figure  2)  was  the  J85-GE-5,  which  was 
installed  on  the  first  production  aircraft  and  began 
flight  testing  in  January  1960.  The  -5  produced 
2,850  lbs.  of  thrust  dry,  and  3,850  lbs.  of  thrust  in 
afterburner.  In  all,  1,187  T-38s  were  produced. 

Closely  following  the  development  of  the 
T-38  was  Northrop’s  N-156F  design,  a  single-seat 
fighter  sharing  many  of  the  major  components  and 
characteristics  of  the  T-38  and  eventually  becoming 
the  F-5  (Figure  3).  Being  so  close  in  timing  to  the 
T-38,  the  first  F-5  prototype  was  also  fitted  with 
J85-GE-ls,  going  supersonic  on  its  July  30,  1959 
maiden  flight  even  with  these  non-afterburning 
engines  (Scutts).  The  production  F-5A/B  series  of 
aircraft  were  equipped  with  the  J85-GE-13, 
producing  4,080  lbs.  in  afterburner. 


Figure  3:  Northrop  F-5A 


The  material  used  in  the  eight-stage 
compressor  rotor  and  blades  was  steel-based 
AM355.  These  materials  were  consistent  with  the 
expected  usage,  environment,  and  anticipated 
service  life  of  these  original  aircraft  and  other 
potential  applications.  The  inherent  versatility  and 
flexibility  of  the  J85  led  to  the  development  of 
multiple  versions  to  be  the  primary  powerplant  for  a 
substantial  number  of  military  aircraft,  and  as  an 
auxiliary  thrust  powerplant  for  others  (Figure  4).  It 
even  came  full  circle  back  to  its  beginnings, 
powering  the  Teledyne  Ryan  MQM-34  Mod  II 
reusable  drone. 
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-*  -f* 


Northrop  T-38A 


Fiat  G.91  Y  Saab  105 


CanadairCL-41G 


Northrop  F-5A/B/E/F 
CF-5,  NF-5 


Rockwell 

International 

OV-IOB(Z) 


Fairchild  AC-119K 


Fairchild  C-123K 


McDonnel  Douglas  Teledyne  Ryan  Firebee 
ADM-20  (GAM-72)  MQM-34  Mod  II 


Rockwell  International 
T-2C/D/E 


Cessna  A-37A/B 


Figure  4:  The  J85  Aircraft  Family 


Being  incorporated  on  this  wide  variety  of 
aircraft  ensured  a  long-lived,  robust  production 
volume.  An  impressive  total  of  9,592  engines  were 
built,  including  licensed  production,  as  shown  in 
Table  1.  At  last  count,  some  4,500  of  these  engines 
were  still  in  active  service  around  the  world, 
accumulating  over  900,000  flight  hours  annually.  In 
addition  to  military  production,  the  J85  was 


developed  into  civil  versions  as  well.  The  CJ610 
and  CF700  series  of  engines  shared  the  compressor 
and  basic  configuration  of  the  non-afterburning  J85 
versions,  with  the  CF700  utilizing  an  aft  fan  for 
increased  performance.  Over  3,100  of  these  engines 
were  produced  and  powered  the  early  Learjet  24/25, 
Hansa,  Westwind,  Falcon  20,  and  Sabre  75  business 
jets. 


Model 

Number 

Produced 

Aircraft  Type(s) 

Engine  Type 

Thrust  (lbs) 

J85-GE-4 

740 

T-2C/D/E;  OV-IOB(Z) 

Dry 

2,950 

J85-GE-5 

2,826 

T-38 

Afterburning 

3,850 

J85-GE-7 

577 

ADM-20,  MQM-34 

Dry 

2,100 

J85-GE-13 

2,330 

F-5A/B 

Afterburning 

4,080 

J85-GE-13A* 

201 

G.91Y 

Afterburning 

4,080 

J85-CAN-15* 

609 

CF-5,  NF-5 

Afterburning 

4,300 

J85-GE-17 

544 

AC-119K,  C-123K 

Dry 

2,850 

J85-GE-17A 

1,404 

A-37 

Dry 

2,850 

J85-GE-17B 

101 

Saab  105 

Dry 

2,850 

J85-CAN-40* 

260 

CL-41 

Dry 

2,850 

Total 

9,592 

*  =  Licensed  Production 

Table  1:  Eight-Stage  Compressor  J85  Engine  Production 
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A  New  Nine-Stage  Compressor  for 
Increased  Thrust 

As  with  most  fighter  aircraft  programs, 
Northrop  began  investigating  ways  of  offering 
improved  performance  in  its  F-5  series  to  counter 
the  growing  capabilities  of  threat  aircraft  and 
countries*  Predictably,  these  centered  on  increasing 
the  thrust  available  from  the  current  J85  series.  GE 
had  begun  testing  on  a  new  nine-stage  compressor 
of  increased  diameter  in  1963  (Scutts),  with  the 
goal  of  creating  a  J85  that  could  produce  over  3,800 
lbs.  of  thrust  dry  and  5,000  lbs.  of  thrust  in 
afterburner.  The  new  compressor  rotor  and  blades 
were  made  of  titanium  alloy,  primarily  to  decrease 
the  weight  associated  with  the  increased  size.  The 
rotor  itself  eliminated  many  of  the  individual  disks 
that  were  used  in  the  previous  compressor  by  going 
to  a  spool  concept,  which  essentially  combined 
multiple  disks  into  a  single  continuos  part.  These 
changes  produced  a  compressor  with  a  much 
greater  pressure  ratio  and  airflow,  decreased  parts 
count,  and  which  also  drastically  reduced  any 
susceptibility  to  corrosion  compared  to  the  previous 
AM355-based  eight-stage  compressor. 

This  version  of  the  J85  became  the  J85-GE- 
21,  and  was  flown  on  a  modified  F-5B  on  March 
28,  1969.  The  -21  became  the  production  engine 
for  the  F-5E/F  aircraft,  and  flew  for  the  first  time  on 
an  F-5E  (Figure  5)  in  August  1972  (Scutts).  When 
production  of  this  engine  ceased  in  1987,  3,482 
units  had  been  produced  including  170  under 
license.  Approximately  2,500  engines  remain  in 
service  today. 


Figure  5:  Northrop  F-5E 


Updating  the  Eight-Stage  Compressor 

In  the  1990s,  the  USAF  had  approximately 
500  T-38s  powered  by  the  J85-GE-5  still  in  service, 
with  other  users  having  active  fleets  as  well. 
Various  studies  and  analyses  by  the  USAF  on  how 
best  to  accommodate  their  advanced  flight  training 
requirements  led  to  the  development  of  a 


comprehensive  T-38  upgrade  program.  This 
program  committed  substantial  resources  to 
avionics  and  aircraft  structural  improvements 
significant  enough  to  warrant  an  aircraft  designation 
change  (to  T-38C),  enabling  T-38  operations  until 
the  2040  timeframe,  some  eighty  years  after  its  first 
flight.  Flowever,  limited  effort  was  devoted  to 
addressing  propulsion  system  reliability  and 
performance.  It  was  against  this  backdrop  that  the 
1995  loss  of  a  T-38  due  to  engine  failure  led  to 
efforts  to  address  modernization  of  the  propulsion 
system  as  well. 

Through  operational  experience,  it  became 
known  that  the  AM355  material  properties  and  disk 
configurations  of  the  eight-stage  compressor  were 
susceptible  to  corrosion  over  time,  which  led  to  pits 
and  cracks  affecting  the  calculated  low-cycle 
fatigue  limits.  A  series  of  life  limit  decreases  were 
implemented  over  the  ensuing  years,  driving 
increased  maintenance  costs  of  the  J85  to  ensure 
adequate  safety.  Exacerbating  this  susceptibility 
were  changes  in  the  mission  environment  and  usage 
that  were  not  fully  documented.  Understandably, 
subtleties  in  the  usage  and  its  effects  on  the  design 
had  crept  in  since  the  original  rotor  was  developed 
in  the  late  1950s,  not  the  least  of  which  was  a  50% 
increase  in  the  mission  severity  factor  for  low-cycle 
fatigue.  The  management  and  premature  retirement 
of  the  compressor  rotors  became  the  number  one 
maintenance  driver  for  the  T-38  as  a  result. 

Development  of  a  spooled  rotor,  similar  to 
the  design  of  the  nine-stage  -21  titanium 
compressor,  was  proposed  through  the  USAF 
Component  Improvement  Program  (CIP)  in  1 994  to 
address  the  reduced  compressor  rotor  life  limits. 
The  cost  of  this  program  exceeded  available  USAF 
funding  at  the  time,  and  the  life  cycle  cost  analysis 
did  not  support  giving  the  project  very  high  priority. 
In  1995,  operational  events  drove  a  re-examination 
of  the  need  for  a  new  rotor,  with  the  most 
significant  one  being  the  loss  of  a  T-38  due  to 
engine  failure.  Investigation  into  this  mishap 
revealed  that  an  uncontained  failure  of  an  8th  stage 
compressor  disk  had  occurred,  with  corrosion 
identified  as  the  root  cause.  Clearly,  a  program  to 
address  the  life  of  the  compressor  rotor  was 
required  if  the  T-38  were  to  remain  operational  as 
planned. 

The  USAF’s  boundary  conditions  for 
developing  a  new  rotor  system  for  the  J85-GE-5 
were  quite  severe,  with  overall  cost  and  minimized 
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program  risks  being  primary  considerations.  No 
major  aircraft  modifications  were  allowed,  the  new 
rotor  design  had  to  be  a  “drop-in”  replacement  to 
ensure  maximum  compatibility  with  in-service 
engine  components,  and  a  weight  increase  of  no 
more  than  10  lbs.  per  engine  was  specified.  These 
conditions  were  made  all  the  more  difficult  by  the 
limited  availability  of  CIP  funding  from  the  USAF 
to  accomplish  this  task.  With  increased  CIP  funding 
being  highly  unlikely,  the  USAF  asked  GE  to 
consider  a  team  approach  to  launch  a  viable  design 
and  production  effort. 

GE  responded  positively  to  this  request  and 
proposed  a  team  consisting  of  the  USAF,  GE,  and 
ABB  Alstom  to  share  the  development  cost.  Due  to 
the  exceptional  number  of  in-service  eight-stage 
compressor  engines  around  the  world,  there  was  a 
viable  business  case  for  a  new  rotor  design  outside 
of  USAF  purchases.  This  situation  allowed  the 
creation  of  a  unique  investment,  certification,  and 
data  rights  agreement  that  minimized  the  USAF’s 
CIP  investment.  Essentially,  the  agreement  allowed 
the  USAF  to  limit  its  investment  to  approximately 
15%  of  the  expected  development  cost  upfront, 
essentially  providing  the  seed  money  for  the 
program.  GE  and  ABB  Alstom  agreed  to  fund  the 
remainder  of  the  development  and  certification  in 
exchange  for  exclusive  rights  to  the  eventual 
design.  The  design  was  to  be  certified  to  U.S. 
Federal  Aviation  Administration  guidelines  under 
FAR33  rules,  with  the  proviso  that  GE  and  ABB 
Alstom  provide  additional  information  to  the  USAF 
under  the  CIP  umbrella  for  analysis  and 
verification.  As  a  consequence,  the  new  rotor  would 
be  made  available  in  a  commercial  catalog,  with 
standard  commercial  terms,  conditions  and  pricing. 
The  innovative  approach  sponsored  by  the  USAF 
allowed  the  service  to  realize  a  huge  return  on  a 
relatively  small  investment. 

With  the  business  side  taken  care  of, 
attention  turned  to  the  task  of  designing  a  new  rotor. 
Fundamentally,  the  airflow  characteristics  and 
aeromechanics  of  the  current  compressor  design 
were  exceptionally  sound,  and  there  was 
considerable  reluctance  to  change  the  flowpath 
configuration  in  any  new  design.  The  decision  was 
made  to  keep  the  current  airfoil  and  flowpath 
contours,  which  would  also  allow  use  of  the 
existing  cases  and  stators  with  minimal  risk.  The 
primary  need  was  to  select  a  new  rotor  material  that 
would  eliminate  the  risk  of  corrosion,  and  marry  it 


to  the  spooled  rotor  concept  developed  for  the  -21 
engine. 

At  first,  it  appeared  that  use  of  titanium  as 
in  the  -21  would  simultaneously  address  the 
corrosion  issue  as  well  as  minimize  any  weight 
growth  due  to  rotor  design  changes.  However,  there 
was  no  previous  GE  experience  of  using  steel-based 
blades  in  a  titanium  spool  for  the  military 
environment.  This  combination  had  been 
successfully  fielded  in  commercial  engines,  but  the 
increased  cycling  and  operational  stresses  inherent 
in  military  use  raised  concerns  over  fretting  taking 
place  at  the  blade  to  rotor  interface.  While  there  was 
the  potential  to  provide  a  protective  coating  at  this 
interface,  it  was  felt  that  this  introduced  an 
unnecessary  element  of  risk  and  would  have 
increased  long-term  costs  in  maintaining  the 
coating.  Replacement  of  the  AM355  steel  blades 
with  titanium  blades  was  also  considered,  but  was 
rejected  due  to  the  larger  axial  clearances  needed 
and  the  incompatibility  of  the  existing  inventory  of 
blades  with  the  new  rotor.  The  best  solution 
appeared  to  be  the  selection  of  a  steel-based 
material  with  corrosion  properties  superior  to 
AM355,  which  proved  to  be  Inconel  718. 

Inco  718  had  previously  been  used  as  a 
vane  material  in  the  J85,  and  promised  excellent 
resistance  to  corrosion.  With  a  target  of  a  3:1 
increase  in  the  low  cycle  fatigue  life  limit  using 
both  probabilistic  and  deterministic  methodologies, 
a  design  was  produced  that  replaced  the  eight 
individual  disks  with  one  disk  and  two  spools 
(Figure  6).  This  redesign  resulted  in  a  dramatic  8:1 
reduction  in  parts  count,  a  5:1  reduction  in 
projected  maintenance  man-hours,  and  eliminated 
high  stress  concentration  rim  bolt  holes.  It  also 
provides  the  capability  for  individual  blade 
replacement  without  rotor  disassembly  or 
rebalancing. 
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Current  Rotor 

8  individually  High  Parts 

Count 


bolted  stages 


FORWARD 


Redesigned  Spooled  Rotor 


Front  Spool 

Stages  1  &  2 


High  Stress 
Disk  Rim  Bolt 
Holes  Eliminated 


Stage  3 
Disk 


Rear  Spool 

Stages  4  -  8 


Figure  6:  Design  Comparison  of  Eight-Stage  Compressor  Rotors 


However,  by  using  Inco  718  versus 
titanium  for  the  new  spooled  rotor  design,  the 
weight  increased  by  20  lbs.  over  the  current  rotor, 
exceeding  the  requirement  by  10  lbs.  The  design 
was  purposely  conservative  in  order  to  be  robust  in 
service  and  have  margin  for  the  LCF  life  target,  but 
could  have  been  made  somewhat  lighter  with 
further  design  effort.  A  study  revealed  the 
negligible  impact  of  a  40  lb.  propulsion  system 
weight  increase  for  the  T-38,  and  the  new  design 
was  accepted  by  waiver  to  the  original  and 
somewhat  arbitrary  weight  requirement. 

In  keeping  with  the  FAR33  certification 
process,  the  new  compressor  was  not  test  flown  on 
a  military  aircraft.  Instead,  the  test  vehicle  was  a 
Learjet  24/25  with  one  of  its  engines  having  been 


modified  with  the  new  compressor.  The  civil 
CJ610-6  engine  is  closest  in  configuration  to  the 
J85-GE-5,  and  a  -6  was  modified  and  flown  to 
provide  the  necessary  data  for  certification.  This 
testing  was  completed  in  early  2000,  with  a  dirty 
and  clean  layout  inspection  of  the  hardware 
scheduled  for  later  that  year.  In  keeping  with  the 
risk  mitigation  process  employed  throughout  the 
redesign  effort,  testing  of  the  new  compressor  was 
accomplished  both  with  new  compressor  cases  and 
older  production  cases  representative  of  those  that 
would  be  encountered  during  the  retrofit  program. 
All  of  these  test  combinations  have  been  successful, 
with  a  spooled  rotor  expected  to  be  available  as  a 
standalone,  drop-in  replacement  kit  (Figure  7)  in 
late  2000. 


A  spooled  rotor  assembly  kit 
comes  with  a  complete  set  of 
new  compressor  blades  and  a 
new  compressor  discharge 
pressure  seal 


Figure  7:  Redesigned  Eight-Stage  Compressor  Rotor  Assembly 
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Improvements  Beyond  the 
Compressor  Rotor 

The  success  of  the  initial  look  at  updating 
the  compressor  rotor  prompted  the  USAF  to 
undertake  a  comprehensive  review  of  what  could  be 
done  to  address  other  issues  on  the  J85.  This  review 
centered  developing  a  long-range  propulsion 
roadmap  that  would  be  consistent  with  the  T-38 
structural  and  avionics  upgrade  programs  allowing 
operations  into  the  2040  timeframe.  The  roadmap 
was  to  develop  options  that  focused  on  reducing  the 
cost  of  ownership,  and  increasing  the  overall  safety, 
reliability,  and  durability  of  the  propulsion  system. 
These  options  fell  into  the  broad  categories  of 
component  improvements,  engine  module  upgrades, 
aircraft  system  enhancements,  maintenance-related 
changes,  and  even  the  possibility  of  re-engining. 
Table  2  lists  some  of  the  items  analyzed  during  the 
propulsion  roadmap  study. 


As  with  the  spooled  rotor  redesign  effort, 
funding  to  develop  and  acquire  these  upgrades  was 
in  short  supply.  Each  task  was  analyzed  for  return 
on  investment  and  life  cycle  cost  benefit,  and  then 
balanced  against  the  available  funding.  The  net 
result  of  this  study  was  the  definition  of  a  set  of 
upgrades  for  the  T-38C  that  would  collectively  be 
known  as  the  J85  Propulsion  Modernization 
Program,  or  PMP.  At  the  heart  of  this  upgrade 
program  was  the  new  eight-stage  spooled 
compressor  rotor  described  previously.  Figure  8 
identifies  the  major  kits  that  comprise  the  PMP. 
While  some  of  the  upgrade  items  in  Table  2  were 
not  selected  for  the  PMP,  they  remain  viable 
candidate  programs  to  address  other  customers’ 
requirements  for  J85  improvements,  while  several 
more  programs  exist  for  the  -21  version  of  the  J85. 


Components 

Long  Life  Combustor 
Cast  Nozzle  Flaps  &  Seals 
Stacked-Ring  Afterburner  Liner 
Ignition  Plugs  &  Leads 
Variable  Geometry  Actuator 
Compressor  Case 
Ignition  Exciter 

Afterburner  Fuel  Pump  Upgrade 
Main  Fuel  Pump  Upgrade 
Hydraulic  Nozzle  Actuation 
Afterburner  Fuel  Control 
Digital  T5  Amplifier 
Mainframe  Upgrade 
Full  Authority  Digital  Engine  Control 
T2  Sensor  Replacement 
Compressor  Bleed  Valves 


Modules 

Spooled  Compressor  Rotor 
Mini-Growth  Turbine 
New  Design  Turbine 
New  Turbomachinery 
New  Design  Compressor 

Aircraft  Systems 

Ejector  Nozzle 
Inlet  Lip  Modification 

Maintenance 

T5  Motor  Overhaul 
Overspeed  Governor  Overhaul 
Master  Chip  Detector 
Heatshield  Access  Port  to  Igniter 

Re-engining 

New  Centerline  Engine 
Alternate  Engine 


Table  2:  T-38/J85  Propulsion  Roadmap  Items 


The  PMP  wasn’t  just  a  program  to  put  old 
part  designs  back  into  production,  making  new 
“old”  production  hardware.  The  opportunity  to 
analyze  significant  amounts  of  field  data  and  apply 
state  of  the  art  materials,  designs,  and  production 
techniques  was  taken  with  a  vengeance. 


In  conjunction  with  providing  a  new 
compressor  rotor,  new  stator  cases  were  made 
available  with  increased  corrosion  resistance.  This 
was  accomplished  by  changing  from  AM355  base 
material  with  coating  in  the  stator  lands  to  Inconel 
as  the  base  material,  eliminating  the  need  for 
coatings  and  their  high-maintenance  care. 
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SpoQled  Rotor 
Complete  Set  of  Blades 
Stage  8  Static  Seal 


New  Inco  Stator  Casing 
Inco  Vanes 
Split-line  Hardware 


Longer  Life 
Combustion  Liner 
Assy. 


Turbine  Casing 
Stage  1  &  2  Nozzles, 
Shrouds  & 
Split-line  Hardware 


Ignition  Electrical  System 

Exciter,  Main  &  AB  Plugs  & 
Leads  plus  Clamps 


Figure  8:  J85  Propulsion  Modernization  Program  Upgrades 


A  new  single-piece  cast  mainframe  was 
created  to  replace  the  original  39  piece  welded 
design,  as  well  as  introducing  Inconel  for  improved 
corrosion  resistance.  The  welded  design  was 
susceptible  to  fatigue  cracking  that  originated  along 
the  edges  of  the  welds  joining  the  struts  and  pads  to 
the  outer  shell.  While  repair  of  the  cracks  is 
possible,  it  is  expensive  both  in  cost  and  engine 
down  time. 

Taking  advantage  of  new  materials  and 
coatings  allowed  a  significant  increase  in  the 
reliability  of  the  J85  combustor.  By  applying 
revised  thermal  barrier  coatings  (TBC)  and  placing 
it  in  additional  areas  of  the  combustor,  both  the 
service  life  and  inspection  intervals  have  been 
increased  by  a  factor  of  2  to  1 . 

Addressing  the  traditional  high  distress  area 
of  engines  was  accomplished  by  providing  a 
comprehensive  upgrade  kit  for  the  high  pressure 
turbine  section.  A  new  turbine  casing  with  revised 
Stage  1  and  2  nozzles  was  able  to  reduce  cracking 
by  porting  cooling  air  to  new  areas.  New  shroud 
and  turbine  blade  materials  increased  the 
temperature  capability,  allowing  greater  time  on 
wing. 


major  focus  of  the  PMP,  as  liner  cracking  was  the 
leading  cause  of  unscheduled  engine  removals.  The 
current  liner  design  consists  of  4  major  sections  and 
containing  over  900  parts  in  total.  The  brackets 
used  to  support  the  liner  produced  high  stress 
concentrations.  A  new  stacked  ring  liner  was 
designed  that  is  a  single  major  piece,  with  less  than 
100  additional  parts  required  to  complete  the 
assembly.  The  bracket  system  was  eliminated 
entirely  by  transitioning  to  a  free-floating  design, 
and  TBC  was  applied  in  the  screech  section. 
Durability  for  the  liner  alone  was  increased  by  a 
factor  of  6  to  1.  New  variable  exhaust  nozzle  (VEN) 
leaves  and  afterburner  casing  seals,  changed  as  a 
set,  have  revised  chrome  carbide  and  electroless 
nickel  coatings  for  a  3X  service  life  improvement. 

Perhaps  more  mundane  but  no  less  critical, 
the  issue  of  electrical  parts  obsolescence  was 
tackled  in  the  engine  ignition  system.  Certain 
ignition  exciter  components  are  no  longer  available 
at  any  price,  and  the  overall  design  was  seriously 
outdated  (1950’s  electronics  technology).  By 
utilizing  a  modem  exciter  with  new  plugs  and  leads, 
overall  ignition  energy  and  system  reliability  is 
dramatically  increased,  resulting  in  a  reduction  of 
no-starts  and  afterburner  no-lights  by  over  50%. 


Decreasing  the  maintenance  costs  and 
increasing  the  reliability  of  the  afterburner  was  a 


1-9 


System  Level  Improvements 

The  J85  engine  is  but  one  component  of  the 
T-38  aircraft  propulsion  system,  and  the  entire 
system  was  evaluated  in  developing  technology 
options  for  improved  performance  and  reduced  cost 
of  ownership.  Two  items  identified  in  the 
propulsion  roadmap  fall  into  this  category  of 
improvement,  the  ejector  nozzle  and  the  inlet  lip 
modification. 

The  original  configuration  of  the  T-38 
nozzle  ejector  was  sized  for  the  maximum 
afterburner  condition.  This  exit  area  caused  over¬ 
expansion  of  the  exhaust  plume  at  Military  power, 
with  the  result  being  excess  drag  and  lower  overall 


net  thrust.  A  new  system  was  designed  that 
incorporated  free  floating  doors  in  an  ejector  that 
was  a  simple  replacement  of  the  current  hardware. 
The  aerodynamic  actuation  system  resulted  in  an 
effective  variable  size  at  all  power  conditions,  more 
efficiently  controlling  the  plume  expansion.  This 
provides  a  system  level  benefit  in  terms  of  higher 
net  thrust  of  1-2%  at  takeoff  conditions  and  up  to 
10%  at  Military  power,  resulting  in  decreased  fuel 
bum  or  increased  aircraft  performance.  In  addition, 
the  stall-free  engine  envelope  was  increased,  and 
the  nozzle  components  were  exposed  to  a  decreased 
temperature  environment.  Figure  9  shows  the  basic 
configuration  of  the  revised  ejector  design,  and 
Figure  10  compares  the  installation  of  the  revised 
design  to  the  current. 


T 
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The  redesigned  ejector  nozzle  is  shown  installed  on 
a  NASA  T-38,  which  accomplished  a  series  of  risk- 
reduction  flight  tests  to  validate  the  projected 
performance  characteristics  and  improvements.  The 
results  of  the  flight  test  are  shown  in  Figure  1 1 
plotted  on  an  aircraft  flight  map  with  areas  of 
anticipated  performance  increases  displayed, 
confirming  the  analytical  model  of  the  ejector. 

This  significant  performance  increase  could 
be  even  further  enhanced  with  the  incorporation  of 
a  revised  inlet  lip  contour.  The  T-38  was  the  first 


aircraft  to  go  into  production  in  Northrop  N-156 
family,  and  subsequently  aircraft  models  used 
modified  inlet  configurations  to  improve  engine 
performance  and  stall  margin.  Using  this  design 
history  as  a  base,  a  new  inlet  shape  incorporating  a 
fatter  lip  with  a  squarer  profile  was  developed.  This 
new  design  was  also  tested  on  a  NASA  T-38  in  the 
form  of  an  add-on  glove  to  simulate  replacement  of 
the  current  design,  resulting  in  a  startling  22% 
thrust  increase  at  take-off  conditions,  with 
improved  stall  margin  throughout  the  envelope. 


Figure  10:  Comparison  of  Original  Ejector  to  Improved  Ejector  System 


Figure  11:  Ejector  Nozzle  Flight  Test  Results 


Summary 


The  technologies  and  design  capabilities 
available  for  new  engines  today  were  only  a  gleam 
in  propulsion  engineers’  eyes  50  years  ago.  The 
performance,  operating  costs,  inspection  intervals, 
and  service  life  of  engines  designed  in  that 
timeframe  pale  in  comparison  to  modem  military 
engines.  But  those  modem  tools,  combined  with  a 
rigorous  and  honest  analysis  of  fielded  engine 
experience,  can  produce  technology  upgrade 
options  that  rejuvenate  engine  performance  and 
reliability,  yet  are  affordable  to  acquire. 

The  J85  engine  is  a  classic  example  of  an 
engine  with  very  modest  beginnings  being  called 
upon  to  serve  longer  and  used  much  more 
differently  than  was  ever  originally  imagined.  With 
acquisition  of  new  aircraft  all  but  impossible  due  to 
continually  decreasing  military  budgets,  soldiering 
on  with  existing  equipment  is  the  order  of  the  day. 
A  committed  manufacturer,  seeing  with  the  eyes  his 
customer,  cannot  help  but  to  support  the  continued 
operation  of  aging  engines  with  the  technological 
and  intellectual  resources  at  their  disposal.  Indeed, 
GE  Aircraft  Engines  has  embodied  this  spirit  of 
commitment  in  its  internal  policies,  stating  “GE 
Aircraft  Engines  (GEAE)  will  continue  to  provide 
support  for  all  GEAE  products  for  as  long  as  any 
operator  continues  to  use  the  products.”  By 
rationally  packaging  kits  of  engine  upgrades  that 
increase  time  on  wing,  scheduled  inspection 
intervals,  and  overall  system  performance,  it 
becomes  possible  for  users  to  break  the  death  spiral 
of  increasing  maintenance  costs. 
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ABSTRACT 

NATO  countries  are  currently  faced  with  the  need  to 
operate  fleets  of  mature  gas  turbine  engines  built  many 
years  ago.  Because  of  diminishing  resources  for  new 
equipment,  the  prospects  of  replacing  these  engines  with 
new  ones  are  not  good  at  present.  How  long  such  engines 
can  be  kept  in  service  safely,  without  replacing  a 
significant  portion  of  their  aging  structural  components 
has  become  a  growing  concern  to  engine  life-cycle 
managers,  due  to  uncertainties  in  residual  lives.  Another 
concern  is  the  high  maintenance  cost  associated  with  the 
replacement  of  durability-critical  components,  such  as 
blades  and  vanes.  The  need  to  balance  risk  and  escalating 
maintenance  costs  explains  the  growing  interest  in  the 
application  of  life  extension  technologies  for  safely 
extracting  maximum  usage  out  of  life-limited  parts.  In 
the  case  of  aero-engines,  maintaining  airworthiness  while 
ensuring  affordability  is  of  prime  concern  to  both  life- 
cycle  managers  and  regulatory  authorities.  This  lecture 
describes  the  modes  of  deterioration  of  engine 
components  and  discusses  their  effects  on  the 
performance,  operating  costs,  reliability  and  operational 
safety  of  engines.  It  also  identifies  component  life 
extension  strategies  that  engine  life-cycle  managers  may 
adopt  to  cost-effectively  manage  their  engines,  while 
ensuring  reliability  and  safety.  A  qualification 
methodology  for  component  life  extension,  developed 
and  implemented  for  Canadian  Forces  engines,  is 
presented.  The  methodology  incorporates  an  Engine 
Repair  Structural  Integrity  Program  (ERSIP)  that  was 
conceived  to  establish  structural  performance 
requirements  and  identify  tests  for  development  and 
qualification  of  life  extension  technologies,  to  ensure 
structural  integrity  and  performance  throughout  the 
extended  life.  Examples  of  life  extension  technologies 
applied  to  gas  path  components  and  critical  rotating  parts 
are  described,  including  the  use  of  protective  coatings 
and  repairs  to  increase  component  durability.  The 
application  of  damage  tolerance  concepts  to  allow  use  of 
safety-critical  parts  beyond  their  conventional  safe-life 
limits  is  also  illustrated. 

GLOSSARY  OF  ABBREVIATIONS 

AET  Accelerated  Endurance  Tests 

AMT  Accelerated  Mission  Test 

ASMET  Accelerated  Simulated  Mission  Endurance  Test 


CG 

Columnar  grain 

CIP 

Component  improvement  program 

DFM 

Deterministic  fracture  mechanics 

DS 

Directionally  solidified 

EBW 

Electron  beam  welding 

ENSIP 

Engine  Structural  Integrity  Program 

ERSIP 

Engine  Repair  Structural  Integrity  program 

FCGR 

Fatigue  crack  growth  rate 

FEM 

Finite  element  modeling 

FM 

Fracture  mechanics 

FMECA  Failure  Modes  and  Effects  Criticality  Analysis 

FOD 

Foreign  object  damage 

HCF 

High  cycle  fatigue 

LEFM 

Linear-elastic  fracture  mechanics 

LCF 

Low  cycle  fatigue 

LCM 

Life  cycle  management 

LCMM 

Life  cycle  materiel  manager 

LPI 

Liquid  penetrant  inspection 

NDI 

Non-destructive  inspection 

OEM 

Original  equipment  manufacturer 

PFM 

Probabilistic  fracture  mechanics 

POD 

Probability  of  detection 

R&O 

Repair  and  overhaul 

SC 

Single  crystal 

SIF 

Stress  intensity  factor 

SII 

Safe  inspection  interval 

TBC 

Thermal  barrier  coating 

TCP 

Topologically  closed  packed 

TF 

Thermal  fatigue 

TIT 

Turbine  inlet  temperature 

1.  INTRODUCTION 

Turbine  engine  components  accumulate  damage  in 
service  as  a  result  of  their  demanding  operating 
conditions.  The  damage  may  take  many  forms  depending 
on  the  component,  engine  type  and  operating 
environment  [1].  Service-induced  damage  limits  the 
usable  life  of  many  engine  components.  When  damage 
becomes  excessive  as  revealed  by  inspection  or  when 
component  design  lives  are  reached,  the  components  are 
replaced  with  new  ones.  Replacing  service-damaged 
parts  is  costly  and  is  a  significant  contributing  factor  in 
the  overall  life  cycle  cost  of  engines. 

Annual  expenditures  on  replacement  parts  for  modern 
engines  can  be  well  in  excess  of  $50,000  per  engine  [2]. 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “ Aging  Engines,  Avionics,  Subsystems  and  Helicopters ”, 
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Occasionally,  that  cost  may  grow  significantly  when 
components  such  as  compressor  wheels  or  turbine  discs 
need  replacing  because  the  specified  safe-life  for  the 
parts  has  been  reached.  Thus,  at  a  time  of  tight  budgets 
and  diminishing  resources  for  new  equipment  acquisition 
or  equipment  maintenance,  it  is  not  surprising  that  many 
NATO  engine  fleet  managers  have  been  exploring  every 
possible  way  to  extend  the  usable  lives  of  expensive 
components.  In  the  case  of  old  engines,  in  particular 
those  that  were  designed  more  than  40  years  ago,  the 
fleet  managers  may  have  to  face  additional  challenges 
due  to  the  scarcity  of  spare  parts  or  spares  not  being 
available.  In  the  absence  of  spare  parts,  uncertainties  in 
component  residual  lives  may  be  cause  for  concern. 

For  engine  life  cycle  managers  to  ask  the  right  questions 
and  make  the  right  decisions,  they  need  to  clearly 
understand  how  engine  components  deteriorate  in  service 
and  how  this  deterioration  impacts  on  the  performance, 
operating  cost,  reliability  and  safety  of  engines.  They  also 
need  to  know  how  to  take  advantage  of  the  latest 
developments  in  component  life  extension  technologies 
to  cost-effectively  manage  their  engines.  In  this  respect,  it 
is  important  for  fleet  managers  to  be  fully  cognizant  of 
the  requirements  to  qualify  the  life  extension 
technologies  for  ensuring  the  engines  remain  reliable  and 
safe  to  operate  upon  return  to  service. 

The  objective  of  this  paper  is  to  provide  engine  managers 
with  guidance  and  strategies  for  the  development  and 
implementation  of  new  or  existing  life  extension 
technologies.  It  describes  the  modes  of  deterioration  of 
engine  components  and  how  the  damage  affects 
structural  integrity.  It  reviews  procedures  applied  to 
manage  aging  components  and  some  of  the  latest 
developments  in  component  life  extension.  It  explains  the 
Qualification  Methodology  developed  jointly  by  the  NRC 
Institute  for  Aerospace  Research  (IAR)  and  Orenda 
Aerospace  Corporation  (OAC)  for  the  Canadian 
Department  of  National  Defence  (DND).  Finally,  it 
provides  examples  of  substantiation  test  programs  that 
have  been  used  to  qualify  some  recently  developed  life 
extension  schemes  for  CF  engines. 

2.  MODES  OF  DETERIORATION  OF  ENGINE 
COMPONENTS 

Damage  incurred  by  engine  components  during  service 
may  be  external,  affecting  dimensions  and  surface  finish 
as  a  result  of  fretting,  wear,  erosion,  corrosion  or 
oxidation.  It  may  also  be  internal,  affecting  the 
microstructure  of  highly  stressed  and  hot  parts,  as  a  result 
of  aging  of  the  material  microstructure,  creep  or  fatigue. 
External  damage  impacts  significantly  on  functionality  of 
the  parts,  including  the  aerodynamic  performance  of  gas 
path  components,  but  may  also  reduce  their  load  bearing 
capacity.  Surface  damage  in  the  form  of  low  cycle  fatigue 
(LCF)  cracks,  scars  or  dents,  fretting-wear  or  foreign 
object  damage  (FOD),  respectively,  may  lead  to  high 
cycle  fatigue  (HCF)  failures  [3].  Internal  damage  may 
reduce  component  strength  and  lead  to  component 
distortion.  Its  accumulation  also  causes  the  initiation  of 
flaws,  which  may  ultimately  lead  to  cracking  and 
component  failure.  Examples  of  external  and  internal 


forms  of  damage  and  component  distortion  and  cracking 
are  presented  below. 

2.1  Surface  Damage 

2.1.1  Fretting  is  caused  by  oscillatory  motion  of  very 
small  amplitude  between  two  contacting  surfaces.  It 
occurs  in  engines,  for  instance,  where  blades  come  in 
contact  with  discs.  The  rubbing  motion  between  the 
components  generates  debris  that  is  trapped  between  the 
two  contacting  surfaces  and  may  lead  to  scoring.  The 
resulting  surface  scar  may  act  as  a  stress  raiser  and  give 
rise  to  fretting-fatigue  cracks.  Both  fan  and  compressor 
sections  are  susceptible  to  this  form  of  damage.  The 
susceptibility  to  fretting  of  blades  and  discs  is  governed 
by  many  geometric  and  materials  factors.  The  latter 
include  the  difference  in  hardness  between  the  blade  and 
the  disc  materials,  the  magnitude  of  surface  residual 
stresses  and  the  lubrication  of  the  contact  surfaces. 
Depending  on  the  hardness  ratio  either  one  of  the 
components  may  incur  the  damage.  A  close  up  view  of 
fretting  damage  incurred  by  the  dovetail  of  a  compressor 
blade  is  shown  in  Fig.  1. 

Fretting  tends  to  reduce  HCF  life,  but  may  also  impact  on 
LCF  life  of  the  parts.  Fretting  may  also  affect  splines, 
couplings,  clutches,  spindles  and  seals.  It  may  occur  in 
joints  that  are  bolted,  keyed,  press  fitted,  shrunk  or 
riveted.  Fretting  can  be  minimized  trough  use  of  anti¬ 
fretting  compounds,  including  soft  coatings,  and  surface 
modification  treatments  [4], 


Figure  1 .  Dovetail  of  a  compressor  blade  from  a  CF 
engine  subject  to  fretting  damage,  showing  deep 
fretting  scar.  The  surface  damage  may  lead  to  HCF 
or  LCF  failures. 

2.1.2  Erosion  of  compressor  airfoils  is  caused  by 
ingestion  of  hard  particulate  matter  through  the  engine  air 
intake.  The  impacting  action  of  gas  entrained  hard 
particles  on  gas  path  components  leads  to  gradual 
removal  of  material,  which  given  sufficient  service  time 
can  significantly  alter  component  shape  and  surface 
finish.  The  change  in  geometry  can  be  quite  severe  as 
evidenced  by  the  eroded  airfoils  of  the  compressor  vane 
segment  shown  in  Fig.  2.  Change  in  leading  edge  radius 
and  surface  roughening  can  significantly  reduce 
compressor  efficiency  and  engine  performance.  In 
extreme  cases,  geometry  changes  may  alter  the  modal 
response  of  the  airfoils,  to  the  point  where  they  may  be 
excited  at  their  natural  frequencies  under  normal 
operating  conditions.  Such  resonant  vibration  may  lead  to 
HCF  failures  of  blades.  Erosion  of  compressor  gas  path 
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components  can  be  minimized  through  the  use  of  inlet 
particle  separators  or  by  enhancing  the  erosion  resistance 
of  airfoils  through  use  of  protective  coatings  or  surface 
modification  treatments  [5]. 


Figure  2.  Erosion  damaged  CF  T56  compressor 
vane  segment  after  approximately  5000  hrs  of 
service. 


Figure  3.  Corrosion  pits  close  to  the  root  of  a 
compressor  blade  exceeding  damage  allowable 
limits. 

2.1.3  Pitting  corrosion  may  occur  in  the  presence  of 
environments  containing  a  high  concentration  of  chloride 
ions,  for  instance  in  a  marine  environment.  Both  stainless 
steel  and  titanium  alloys  are  particularly  susceptible  to 
this  form  of  damage.  Corrosion  pits  can  have  a  dramatic 
effect  on  the  structural  integrity  of  compressor  parts. 
Depending  on  the  type  of  component  and  the  location  of 
the  corrosion  pits,  they  may  act  as  crack  initiation  sites 
for  HCF  or  LCF  cracks.  Corrosion  pits  of  the  type  shown 
near  the  root  of  the  compressor  blade,  Fig.  3,  would 
normally  be  cause  for  blade  rejection  [6].  If  left 
unchecked,  this  form  of  damage  may  lead  to  catastrophic 
component  failure.  Corrosion  control  may  be  achieved 
through  use  of  protective  coatings[7]. 

2.1.4  Oxidation  damage  is  cause  for  rejection  of  a 
significant  fraction  of  turbine  blades  and  vanes  during 
scheduled  engine  maintenance.  Oxidation  reduces  the 
thickness  of  airfoils  and  their  load  bearing  capacity.  It 
may  also  give  rise  to  sites  for  HCF  or  LCF  crack 
initiation.  In  cooled  blades,  oxidation  of  normally 
uncoated  internal  cooling  passages  may  combine  with 
external  surface  oxidation  to  reduce  component  wall 
thickness  and,  thus,  the  load  bearing  capacity  of  the  blade 
[8].  The  coatings  that  are  applied  to  most  of  these  parts, 
over  their  airfoil  portions,  provide  some  protection 
against  high  temperature  oxidation.  The  coatings  are 


aluminide  intermetallic  compounds  designed  to  form  a 
protective  oxide  scale  that  prevents  ingress  by  oxygen 
and  further  oxidation.  However,  coating  life  is  limited 
due  to  spalling  of  the  protective  oxide  scales  and  gradual 
consumption  of  the  coating  elements.  Thus,  ultimately, 
even  the  coated  parts  need  replacing. 

Components  made  of  stronger  superalloys  are  often 
subjected  to  higher  operating  temperatures  than  their 
weaker  counterparts  and,  therefore,  they  are  exposed  to 
more  aggressive  oxidizing  environments  during  service. 
Thus  component  made  of  directionally  solidified  (DS) 
alloys  with  either  columnar  grained  (CG)  or  single  crystal 
(SC)  microstructures  are  often  life  limited  due  to  surface 
oxidation.  The  problem  can  be  quite  severe  at  turbine 
blade  tips,  because  any  protective  coating  wears  off 
rapidly  at  this  location,  due  to  tip  rub.  In  the  case  of  CG 
blades,  tip  oxidation  may  lead  to  thermal  fatigue  cracking 
of  the  longitudinal  grain  boundaries  that  are  embrittled  as 
a  result  of  boundary  oxidation,  Fig.  4  [9]. 

Figure  4.  Tip 
cracking  of  a  DS- 
CG  blade  caused 
by  thermal  fatigue 
of  longitudinal  grain 
boundaries 
embrittled  as  a 
result  of  grain 
boundary  oxidation. 


Blades  and  vanes  may  be  recoated  in  conjunction  with 
other  refurbishment  or  repairs  performed  during  engine 
overhaul.  Tip  repairs  are  an  option  for  CG  and  SC  blades 
[10]. 

2.1.5  Hot  corrosion  is  a  form  of  accelerated  high 
temperature  oxidation/sulphidation  that  may  destroy  hot 
gas  path  components  when  they  are  exposed  to 
deleterious  mixtures  of  reactive  contaminants  originating 
from  the  fuel  and  the  ingested  air.  At  temperatures  in  the 
range  from  850  to  950°C,  residual  sulfur  from  the  fuel 
combines  with  sodium  chloride  picked  up  from  a  marine 
environment  to  form  sodium  sulfate.  This  corrosive 
compounds  fluxes  protective  oxide  scales,  which 
destroys  coatings,  thereby  exposing  the  substrate  material 
to  the  environment.  Once  a  hot  corrosion  reaction  starts, 
it  will  quickly  consume  the  component  as  shown  in  Fig.  5 
[8].  Substituting  a  protective  coating  for  another  that  has 
more  resistance  to  hot  corrosion  may  be  a  cost-effective 
option.  The  addition  of  a  coating  to  the  internal  cooling 
passages  of  blades  and  vanes  is  also  an  option  when  hot 
corrosion  occurs  within  the  cooling  passage  [11]. 

2.2  Internal  Damage 

Another  form  of  deterioration  of  engine  components 
results  from  the  accumulation  of  internal  microstructural 
damage.  This  is  an  insidious  form  of  damage  because,  in 
contrast  to  surface  damage,  it  cannot  be  readily  detected 
by  non-destructive  inspection  (NDI)  techniques.  Its  rate 
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of  accumulation  is  strongly  influenced  by  service  stresses 
and  temperature  and,  therefore,  to  a  great  extent  by  user 
practice.  Because  there  are  uncertainties  in  the  temporal 
variation  of  service  stresses  and  temperatures,  internal 
microstructural  damage  cannot  be  easily  predicted. 

Internal  microstructural  damage  is  the  result  of  plastic 
strain  accumulation  and  metallurgical  aging  reactions  [1]. 
Plastic  strain  accumulation  is  the  product  of  fatigue 
and/or  creep,  which  affects  highly  stressed  and  hot  parts, 
such  as  compressor  and  turbine  discs,  as  well  as  turbine 
blades  and  vanes.  Metallurgical  aging  reactions  affect 
mostly  hot  gas  path  components.  They  may  also  occur  in 
the  rim  of  discs  in  small  turbines,  which  often  operate  at 
higher  operational  speeds  and  temperatures  than  do  larger 
turbines  [9]. 


(c) 


Figure  5.  Hot  corrosion  damage  incurred  by  a  Mar- 
M246  blade  in  the  engine  of  a  CF  maritime  patrol 
aircraft  (a)  pressure  side  view;  (b)  suction  side  view; 
(c)  metallographic  section  taken  halfway  across  the 
airfoil  through  the  hot  corroded  region  [8]. 

2.2.1.  Plastic  strain  accumulation  manifests  itself  in  the 
form  of  dislocation  substructures,  including  persistent 
slip  bands  and  wavy  slip,  which  develop  under  cyclic 
thermo-mechanical  loads  at  stress  concentration  sites 
such  as  disc  bores  and  bolt  holes  or  the  rim  region  of 
rotors,  prior  to  crack  initiation.  The  dislocation 
substructure  shown  in  Fig.  6(b)  is  indicative  of  high 
temperature  LCF  damage  accumulation  in  turbine  discs 
[12].  Such  form  of  micro-damage  accumulation  is  mostly 
dependent  on  number  of  applied  load  cycles.  Plastic 
strain  accumulation  also  manifests  itself  as  creep 
deformation  leading  to  formation  of  creep  cavities  and 
internal  cracks,  Fig.  6(d)  [1]. 

2.2.2  Metallurgical  aging  reactions  include  coarsening, 
agglomeration  and  rafting  of  gamma  prime  precipitates  in 
nickel  base  superalloys,  carbide  coarsening  in  cobalt  base 
superalloys,  degeneration  of  primary  carbides  into 
continuous  carbide  films  along  the  grain  boundaries  of 


polycrystalline  alloys,  and  precipitation  of  topologically 
closed  packed  (TCP)  phases,  such  as  sigma  and/or  mu 
phases  within  the  interdendritic  regions  of  the  alloys  [1]. 
Such  reactions  are  mostly  time  dependent,  although  to 
some  degree  some  can  be  stress  assisted  as  well.  For 
instance,  in  DS  CG  or  SG  alloys,  the  stress  field  within 
components  dictates  the  orientation  of  gamma  prime 
precipitate  rafting. 


Figure  6.  Effects  of  service  exposure  on 
microstructure  (a)  Virgin  disc;  (b)  Service  exposed 
disc  showing  evidence  of  dislocation  activity  (PSB) 
indicative  of  LCF  damage  accumulation  (c)  Virgin 
disc  spacer;  (d)  Service  exposed  disc  spacer 
showing  evidence  of  creep  voids  along  grain 
boundaries;  [1,12]. 


(c)  (d) 


Figure  7.  Internal  microstructural  damage  in  high 
time  blades:  (a)  bimodal  distribution  of  gamma 
prime  precipitates  in  new  blade;  (b)  coarsening  of 
gamma  prime  precipitates  and  elimination  of 
secondary  gamma  prime  in  service  exposed  IN738 
turbine  blade;  (c)  precipitation  of  carbides  (arrows) 
along  grain  boundaries  in  IN738  turbine  blade;  (d) 
precipitation  of  sigma  phase  in  IN  71 3C  blade 
[13,14]. 
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Examples  of  gamma  prime  coarsening,  carbine  reactions 
and  TCP  phase  precipitation  in  nickel  base  superalloys 
are  shown  in  Fig.  7  [13,14].  Precipitate  coarsening  and 
TCP  phase  formation  reduce  material  strength,  whereas 
continuous  carbide  film  formation  and  TCP  precipitates 
embrittle  the  material,  therefore,  making  components 
notch  sensitive.  The  precipitation  of  sigma  phase 
immediately  below  the  protective  coatings,  Fig.  8, 
compounds  the  notch  sensitivity  problem  during  service. 


(a)  (b) 


Figure  8.  Service-induced  precipitation  of  sigma 
phase  immediately  below  the  protective  coating  in  a 
Mar-M246  turbine  blade  from  a  CF  transport  aircraft 
engine;  (a)  new  blade;  (b)  service-exposed  blade. 


(a)  (b) 

Figure  9.  (a)  Airfoil  bowing,  loss  of  coating  and 
cracking  of  a  CF  T56-A15  first  stage  nozzle  guide 
vane;  (b)  Crack  initiating  from  bolt  hole  in  CF  j85 
CAN40/1 5  compressor  disc  [15,16]. 

2.3  Distortion  and  Cracking 

Under  creep  loading  conditions,  the  loss  of  strength 
caused  by  service- induced  metallurgical  ageing  leads  to 
component  distortion.  Vane  airfoil  bowing  or  lengthening 
and  untwist  of  turbine  blade  airfoils  is  commonly 
observed  in  aero  engines  Fig.  9(a)  [15].  Extreme  airfoil 
distortion  may  lead  to  HCF  failures.  Cracking  due  to 
cavity  link-up,  or  oxidation-assisted  creep  cracking  along 
the  grain  boundaries,  usually  follows  microstructural 
damage  accumulation,  in  conjunction  with  component 
distortion.  Microstructural  damage  accumulation  under 
LCF  loading  conditions  is  also  followed  by  crack 
initiation  and  growth  in  highly  stressed  components  such 


as  discs,  Fig  9(b)  [16].  This  type  of  cracking  may  lead  to 
catastrophic  failures. 

3.  MANAGING  THE  DETERIORATION  OF 
ENGINE  COMPONENTS 

For  the  purpose  of  life  cycle  management,  engine 
components  may  be  classified  as  either  durability-critical 
or  safety-critical  [17]. 

(a)  Durability-critical  components,  includes  those  whose 
deterioration  affects  mainly  engine  performance  and  fuel 
efficiency  and  may  result  in  a  significant  maintenance 
burden  but  will  not  normally  impair  flight  safety.  These 
parts  include  cold  and  hot  gas  path  components  such  as 
blades  and  vanes.  The  life  of  these  parts  is  limited  by  one 
of  a  variety  of  possible  modes  of  damage  accumulation, 
which  vary  with  the  type  of  component  and  its  operating 
environment. 

(b)  Safety-Critical  components ,  includes  those  whose 
fracture  may  result  in  the  loss  of  the  aircraft  if  the 
fracture  is  not  contained.  These  components  include  most 
of  the  large  rotating  compressor  and  turbine  components, 
such  as  wheels,  discs,  spacers  and  shafts.  The  life  of 
these  parts  is  usually  limited  due  to  LCF  damage 
accumulation. 

For  durability-critical  parts ,  life  limits  are  rarely 
specified.  An  " On-Condition ”  maintenance  approach  is 
normally  used,  where  parts  are  removed  from  service 
when  measurable  damage  limits  are  reached  [18]. 
Damage  limits  are  specified  in  R&O  Manuals,  including 
for  instance  limits  on  the  extent  of  corrosion  pitting, 
elongation  or  untwist  of  turbine  blades  or  cracking  of 
turbine  vanes.  No  “hard  time”  life  is  set  for  these  parts, 
although  a  minimum  life  expectancy  may  be  guaranteed 
by  the  original  equipment  manufacturer  (OEM)  for 
turbine  blades  and  vanes.  However,  the  difficulties 
associated  with  predicting  service  behaviour  of 
metallurgically  complex  blade  and  vane  materials,  under 
conditions  that  can  vary  widely  with  user  practice,  make 
it  difficult  to  reliably  establish  life  expectancies.  These 
difficulties  are  made  worse  by  complex  coating-substrate 
interactions  that  are  not  usually  well  understood  . 
Consequently,  it  is  not  unusual  for  shortfalls  to  be 
experienced  in  life  expectancies  of  turbine  blades  or 
vanes. 

For  Safety-Critical  parts ,  whose  lives  are  limited  by  LCF, 
two  life  cycle  management  approaches  may  be  used  [18]: 

(a)  The  “ Safe-Life “  approach,  for  which  all  components 
are  retired  before  a  first  crack  is  detectable,  and 

(b)  The  “Damage  Tolerance ”  approach,  for  which 
component  lives  are  established  on  the  basis  of 
fracture  mechanics  (FM)  principles  and  retirement  of 
parts  is  based  on  a  number  of  life  cycle  management 
(LCM)  options,  as  explained  below. 

3.1  The  Safe  Life  Approach 

The  Safe-Life  approach  for  LCM  of  safety-critical  parts 
assumes  that  when  a  crack  appears,  the  component  has 
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failed,  and  it  further  ensures  that  all  similar  components 
are  retired  at  an  equivalent  life,  before  the  first  crack 
appears.  To  that  end,  the  approach  follows  a  “cycles  to 
crack  initiation”  criterion,  with  a  minimum  safe  life  (also 
called  hard  time  life)  capability  established  statistically 
through  extensive  mechanical  testing  of  test  coupons  and 
components  under  simulated  service  conditions.  The 
statistical  minimum  is  based  on  the  probability  that  only  1 
in  1000  component  (-3a)  will  have  developed  a  detectable 
crack,  typically  0.8  mm  in  surface  length,  at  retirement, 
Fig.  10.  This  approach  is  known  in  the  UK  as  the  life-to- 
first-crack  (LTFC)  method,  for  which  the  detectable  crack 
radius  is  chosen  to  be  0.38mm. 


Life  to  crack  initiation 


Frequency 
of  Failures 


Life  (Log  Cycles  to  Crack  Initiation) 


fracture  toughness  of  the  material  and  the  crack  tip  stress 
intensity  factor,  using  appropriate  safety  factors.  In 
practice,  the  SII  is  assumed  to  be  one  half  the  safety  limit. 
The  approach  is  described  schematically  in  Fig.  1 1 . 


Cycles  or  Time 


Figure  1 1 .  The  Damage  Tolerance  approach. 

For  damage  tolerance  based  LCM  of  safety-critical  parts, 
two  implementation  methods  may  be  used,  one  covered 
under  MIL-STD  1783  (ENSIP)  and  the  other  known  as 
Retirement  for  Cause  (RFC)  [18].  A  third  option  known 
as  2/3  Dysfunction  Life  may  also  be  practiced  [19].  Each 
approach  is  explained  below. 


Figure  10.  The  Safe-Life  approach. 

The  advantages  of  the  Safe  Life  approach  are  that  the 
maintenance  requirements  are  kept  to  a  minimum,  while 
the  time  in  service  of  components  without  inspection  is 
maximized.  The  main  disadvantage  of  the  Safe-Life 
approach  is  that  it  may  be  overly  conservative,  because 
components  are  retired  with  a  significant  amount  of 
useful  residual  life  (by  default,  999  out  of  1000 
components  are  retired  with  significant  life  remaining) 
[17,18].  Furthermore,  the  method  is  costly  since  all  parts 
may  need  replacing  nominally  all  at  the  same  time. 
Finally,  the  availability  of  spares  may  be  a  problem  for 
old  engines. 

3.2  The  Damage  Tolerance  Approach 
The  Damage  Tolerance  approach  assumes  that  fracture 
critical  areas  of  components  contain  crack-like 
manufacturing  or  service-induced  defects  giving  rise  to 
the  propagation  of  cracks  during  service.  It  further 
assumes  that  components  are  capable  of  continued  safe 
operation  as  the  cracks  grow  under  thermal  and 
mechanical  stresses.  Cracks  are  assumed  to  grow  in  a 
manner  that  can  be  predicted  from  linear-elastic  fracture 
mechanics  (LEFM),  or  other  acceptable  methods.  Cracks 
are  also  assumed  to  grow  sufficiently  slowly  to  allow 
their  detection  through  regularly  scheduled  inspections. 
Finally,  the  approach  follows  an  inspection  schedule 
established  by  analysis  to  ensure  that  cracks  will  not 
grow  beyond  a  dysfunction  limit,  in  between  inspections. 

The  time  interval  between  the  scheduled  inspections,  or 
safe  inspection  interval  (SII),  is  calculated  as  the  time  it 
takes  a  hypothetical  crack  to  grow  from  a  size 
immediately  below  the  detection  limit,  to  a  dysfunction 
crack  size,  beyond  which  the  risk  of  rapid  or  unstable 
crack  growth  becomes  too  high.  The  dysfunction  crack 
size  is  obtained  for  an  assumed  crack  geometry  from  the 


3.2.7.  ENSIP  (MIL-STD- 1 783) 

The  Engine  Structural  Integrity  Program  (ENSIP)  is  an 
organized  and  disciplined  methodology  introduced  in 
1984  by  the  USAF  for  the  structural  design,  analysis, 
development,  production  and  life  management  of 
engines.  ENSIP  embraces  a  damage  tolerance  approach 
to  set  safe  inspection  intervals  for  life  management  of 
safety-critical  parts.  However,  conventional  structural 
design  criteria  are  also  used  to  minimize  risks  of  failure 
due  to  vibration,  LCF,  HCF  and  creep.  Individual  parts 
(e.g.  compressor  and  turbine  discs)  are  retired  once  their 
safe-life  (LCF  life  to  crack  initiation)  is  reached,  Fig 
12(a)  [18]. 

3.2.2  Retirement  for  Cause 

The  Retirement  for  Cause  concept  is  a  damage  tolerance 
based  method  for  managing  the  life  of  safety  critical 
parts.  The  method  relies  on  fracture  mechanics  to  set  a 
Safe  Inspection  Interval  (SII)  as  practiced  under  ENSIP. 
Retirement  life  is  based  on  periodic  inspections  until  a 
crack  is  detected,  at  which  point  the  part  is  retired. 
Individual  parts,  (e.g.  compressor  and  turbine  discs)  are 
retired  once  they  are  found  to  contain  a  crack,  Fig  12(b) 
[18]. 

The  advantages  of  a  damage  tolerance  based  approach  for 
LCM  of  safety  critical  parts  are  twofold.  Firstly,  the 
approach  ensures  that  cracks  emanating  from 
manufacturing  defects  (or  service  induced  cracks)  in  any 
one  of  the  components  will  not  grow  beyond  dysfunction 
size.  Secondly,  it  allows  life  extension  beyond  LCF  safe- 
life  limits  if  and  when  needed,  through  use  of  the  RFC 
technique  [17,18]. 

However,  there  are  also  some  disadvantages.  The  damage 
tolerance  approach  is  more  costly  to  implement  than  the 
safe  life  approach.  It  requires  an  elaborate  NDI 
infrastructure  to  support  increased  inspection 
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requirements.  Also,  the  handling  of  components  is 
increased.  Finally,  in  the  context  of  new  engine  designs  it 
may  add  weight  to  components  that  are  conceived  for 
damage  tolerance.  Such  components  may  require  thicker 
sections  to  better  tolerate  the  presence  of  cracks  or  to 
ensure  low  crack  growth  rates  [17,18]. 


-3  a  calculated  life 


Cycles  or  Time 


(a)  ENSIP  (b)  RFC 


Figure  12.  Schematic  representations  of  the 
damage  tolerance  approaches  based  on  (a)  MIL- 
STD  1783  (ENSIP);  (b)  Retirement  for  Cause 
(RFC). 

3.2.3  The  2/3  Dysfunction  Life  Approach 
With  this  approach,  developed  in  the  UK,  an  acceptable 
but  variable  margin  of  safety  is  given  by  replacing  the 
detectable  “engineering  crack”  of  the  Safe-Life  approach 
by  a  set  fraction  of  “2/3  of  the  total  life  to  dysfunction”, 
that  is  the  life  before  the  onset  of  rapid  crack  growth.  The 
value  of  2/3  is  chosen  because  experience  has  shown  that 
the  crack  size  at  “2/3  failure”  is  approximately  equal  to 
0.38  mm,  as  defined  in  the  LTFC  method.  For  damage 
tolerant  designs,  in  which  the  2/3 -dysfunction  life 
exceeds  the  LTFC,  this  approach  provides  opportunity 
for  life  extension.  For  such  cases,  FM  crack  propagation 
calculations  may  be  used  to  determine  the  available 
service  life  beyond  “first  crack”  [19]. 

Whatever  is  selected  as  the  LCM  approach,  safe  and 
reliable  prediction  of  component  cyclic  lives  or  safe 
inspection  intervals  requires  an  accurate  knowledge  of 
the  stresses  and  temperature  in  the  parts,  as  well  as  their 
variation  with  time.  A  detailed  knowledge  of  the  response 
of  structural  materials  to  external  forces  and  the 
environment,  especially  in  terms  of  active  modes  of 
damage  accumulation  and  their  interactions  is  also 
important.  Experience  shows  that  there  are  significant 
uncertainties  associated  with  all  these  external  variables, 
as  well  as  with  the  accuracy  of  structural  analysis 
methods  and  damage  modeling  methods  employed  for 
predicting  lives. 

4.  MANAGING  NATO’S  AGING  ENGINE  FLEETS 
Several  of  the  NATO  countries  are  faced  with  having  to 
operate  old  engines  for  which  the  extent  of  damage 
incurred  by  fracture-critical  parts,  and  therefore  the 
residual  lives  of  the  parts,  are  not  accurately  known. 
Owing  to  diminishing  resources  for  new  equipment,  it  is 
not  likely  that  these  engines  will  be  replaced  soon.  How 
long  old  engines  can  be  safely  kept  in  service  without 
having  to  change  a  significant  portion  of  their  structural 
components  has  been  a  growing  concern  amongst  life 


cycle  materiel  managers  (LCMM).  Another  concern  with 
old  engines  is  the  high  rejection  rates  usually  experienced 
for  durability-critical  parts,  such  as  gas  path  components. 
The  high  replacement  cost  of  these  parts  is  a  significant 
life  cycle  cost  driver  in  mature  engine  fleets  and  a  concern 
to  fleet  managers  from  an  affordability  point  of  view.  The 
need  to  balance  risk  and  affordability,  has  provided 
incentives  for  LCMMs  to  identify  and  implement 
strategies  for  extracting  maximum  usage  of  expensive  to 
replace  components,  while  ensuring  the  engines  remain 
safe  to  operate  and  are  reliable  in  service. 

4.1  Engine  Usage  Monitoring  as  a  Tool  for 
Component  Life  Extension 

One  strategy  for  extending  component  lives,  while 
ensuring  safety,  is  to  equip  mature  engines  with  modem 
health  and  usage  monitoring  systems  (HUMS).  In 
principle,  the  temporal  variation  of  any  of  the  engine 
parameters  responsible  for  component  damage  can  be 
measured  with  on-board  monitoring  systems.  By 
applying  suitable  transfer  functions  to  predict  the  residual 
lives  of  parts  from  knowledge  of  their  operating 
conditions,  life  extension  may  be  possible  when  the 
assumed  mission  severity  is  overly  conservative. 

A  more  precise  estimate  of  parts  life  consumption 
obtained  through  the  use  of  HUMS,  in  combination  with 
an  engine  parts  life  tracking  system  (EPLTS),  allows 
operators  to  achieve  more  optimal  use  of  parts  life 
potentials  and  may  help  them  avoid  in-service  premature 
failures.  In  addition,  engine  inspection  schedules  and 
parts  removal  can  be  optimized  to  achieve  a  more  cost- 
effective  maintenance  program,  while  ensuring  safety. 

However,  predicting  parts  life  consumption  from 
knowledge  of  their  operating  conditions  requires  accurate 
models  to  predict  rates  of  damage  accumulation.  Such 
models  are  often  empirical  and  not  very  reliable.  Because 
of  related  uncertainties,  large  safety  factors  are  normally 
imposed  on  LCF  and  other  life  predictions.  The  use  of 
more  reliable  damage  accumulation  models  would 
preclude  the  need  for  conservatism.  In  this  context, 
defining  the  role  of  environment  on  creep-fatigue 
interactions  and  the  impact  of  microstructural  ageing 
reactions  of  mechanical  properties  of  engine  materials  is 
most  important  [1] 

4.2  Other  Strategies  for  Component  Life  Extension 

Other  component  life  extension  options  are  available  to 
engine  fleet  managers. 

For  durability-critical  parts ■  the  options  include 
returning  service-damaged  engine  parts  to  functional 
serviceability  through  use  of  repairs,  such  as  welding, 
brazing,  rebuilding,  re-contouring  and  rejuvenation  heat 
treatments,  or  delaying  the  rates  of  damage  accumulation 
through  the  addition  of  protective  coatings  or  surface 
modifications  treatments.  A  change  of  material  to  a  more 
durable  alternative  is  also  an  option. 

For  safety-critical  parts,  the  option  is  to  implement  a 
damage  tolerance  based  Retirement  for  Cause  approach 
for  life  cycle  management  of  the  components. 
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4.3  Implementation  Requirements 

The  decision  to  replace  component  or  extend  its  life  by 
means  of  one  of  the  above  options,  must  consider  the 
operational  consequences  of  component  failure,  the  cost 
effectiveness  of  the  proposed  life  extension  technique  and 
the  substantiation  testing  that  will  ensure  the  parts  remain 
airworthy,  safe  and  reliable  through  the  life  extension. 

4.3. 1  Safety  Considerations 

The  associated  risks  depend  on  whether  the  component  is 
functionally  or  structurally  significant.  This  can  be  best 
addressed  through  a  reliability  analysis  tool  known  as  a 
Failure  Modes  and  Effects  Criticality  Analysis  (FMECA). 
A  FMECA  is  a  powerful  tool,  usually  computerized,  that 
leads  fleet  managers  through  modes  of  failures  that  can 
occur  on  components,  identifies  the  probability  of  those 
failures  and  the  possible  consequences  of  failure.  It 
provides  data  on  component  failure  rates  obtained  from 
various  sources  (e.g.  field  experience,  R&O,  OEM,  CIP, 
FMS),  on  the  basis  of  which  Fault  Tree  Analysis  (FTA) 
and  Reliability  Block  Diagram  (RBD)  models  can  be 
developed  as  management  tools.  A  FMECA  provides  a 
basis  for  maintenance  logistics  analysis  [2,18]. 

4 . 3. 2  Cost  Considerations 

Operators  must  also  decide  on  cost-effectiveness  of  the 
proposed  life  extension  scheme  for  the  targeted 
application.  A  cost-benefit  analysis  (CBA)  requires  that 
consideration  be  given  to  rates  of  component  rejection, 
the  cost  of  new  parts,  the  cost  of  developing  and 
qualifying  the  proposed  life  extension  technology  and  the 
cost  of  applying  the  technology  in  a  service  environment 
[21,22].  A  sufficient  return  on  investment  is  normally 
required  to  justify  implementation  of  any  life  extension 
scheme,  unless  circumstances  dictate  otherwise.  This  may 
happen,  for  instance,  when  no  spare  parts  are  available 
due  to  a  supply  shortage,  or  because  spare  parts  are  not 
produced  anymore  for  a  very  old  engine. 

4.3.3  Technical  Considerations 

Implementation  of  any  component  life  extension  scheme 
outside  the  scope  of  an  OEM  maintenance  manual,  or  its 
application  beyond  OEM  specified  damage  limits, 
requires  that  the  process  be  carried  out  to  the  same 
standard  the  original  product  was  qualified  to,  or  to  an 
equivalent  standard.  For  military  aero-engines,  the 
applicable  standards  are  MIL-E-5007D,  MIL-E-8593E 
(AS),  MIL-STD-1783  (ENSIP)  or  MIL-STD-1529, 
although  other  standards  may  apply  depending  on  the 
engine  type  and  country  of  origin  [17,  23]]. 

MIL-STD-1529  (Vendor  substantiation  for  aerospace 
products)  describes  procedures  to  qualify 
additional/altemate  vendor  and  fabrication  sources  other 
than  those  qualified  for  the  original  product.  This 
standard  is  therefore  particularly  relevant  to  qualification 
of  life  extension  schemes  [23].  However,  it  does  not 
specify  technical  requirements.  It  simply  states  that 
“substantiation  tests  include  but  are  not  limited  to  those 
tests  required  by  applicable  Government  or  engine 
manufacturers’  specifications”.  The  technical 
requirements  are  contained  in  these  specifications. 


Judging  from  the  Critical  Parts  Qualification  Procedures 
for  T56  Engines  [24],  substantiation  tests  for  qualifying 
parts  subjected  to  life  extension  might  consist  of  the 
following  generic  elements,  depending  on  type  of 
components  and  their  criticality: 

(1)  Dimensional  inspection  to  ensure  that  the  parts 
conform  to  drawing  requirements; 

(2)  Metallurgical  verification  to  ensure  that  the  materials 
conform  to  engineering  specifications; 

(3)  Structural  tests  to  ensure  that  the  relevant  mechanical 
properties  (Creep,  LCF,  TF,...)  are  equivalent  to  or 
better  than  properties  of  original  parts  as  dictated  by 
engineering  specifications; 

(4)  Functional  tests  to  ensure  parts  functionality  is  not 
impaired  by  the  life  extension  process  (e.g.  cooling 
flow  rates  for  internally  cooled  parts  are  identical  to 
flows  in  original  equipment);  and 

(5)  Rig  and  engine  tests  to  verify  that  the  parts  after 
testing  still  meet  the  serviceable  limits  specified  in 
the  applicable  R&O  Manual  and  that  their  general 
condition  is  comparable  to  that  of  approved  parts 
subjected  to  an  identical  test. 

Two  types  of  engine  test  are  specified  in  MIL-E-008593E 
(AS),  the  standard  used  to  qualify  the  various  models  of 
T56  engines.  These  tests  are: 

7.  Accelerated  Endurance  Tests  (AET) 

These  are  over-temperature  tests,  typically  of  150  -  300 
hour  duration,  designed  to  assess  the  durability  of  hot 
section  components,  wear  in  mechanical  parts  and  impact 
of  vibration  of  engine  components.  The  tests  are 
normally  performed  at  a  turbine  inlet  temperature  (TIT) 
at  least  8°C  above  maximum  allowable  steady  state  TIT 
for  power  settings  at  or  above  the  maximum  continuous 
level.  The  tests  may  be  preceded  and  followed  by  a  25 
hour  stair-step  test  schedule  involving  rotational  speed 
and  power  transients.  Once  the  test  is  completed,  engine 
performance  (power,  specific  consumption)  is  compared 
with  that  of  specified  rating  limits.  The  engine  is  then 
disassembled  and  its  parts  are  inspected  for  qualification 
purposes 

2.  Accelerated  Simulated  Mission  Endurance  Tests 
(ASMET) 

These  are  tests  designed  to  simulate  the  effects  of  thermal 
exposure,  LCF  and  thermal  fatigue  on  the  durability  of 
compressor  and  turbine  components.  The  tests  are 
typically  of  600  -  2000  hour  duration,  during  which  the 
engine  is  subjected  to  accelerated  mission  oriented  cycles 
that  are  developed  from  the  expected  mission  profile  of 
the  aircraft. 

5.  THE  CANADIAN  EXPERIENCE 

The  Canadian  Forces  (CF)  have  recently  adopted  a 
qualification  methodology  developed  jointly  by  IAR  and 
OAC  for  component  life  extension,  which  is  being  used 
to  implement  advanced  repairs  and  other  life  extension 
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processes  for  a  variety  of  CF  aero  engine  parts,  including 
components  considered  to  be  flight  critical.  A  knowledge 
base  and  testing  infrastructure  has  been  established  to 
support  these  technologically  challenging  tasks,  with 
financial  assistance  from  DND  [21]. 

Development  of  the  methodology  started  by  a  careful 
review  of  civil  and  military  regulatory  agency 
requirements  applicable  to  the  design  and  life  cycle 
management  of  aero  engines  [23].  The  reviewed 
standards  included  the  United  States  Federal  Air 
Regulations  (FAR  33),  the  Canadian  Airworthiness 
Regulations  CAR  Part  V  (Engine  Standards  -  533),  the 
European  Joint  Airworthiness  Regulations  (JAR-E)  as 
well  as  the  US  military  standards  MIL-E-5007E,  MIL-E- 
8593A,  MIL-STD-1783  (ENSIP),  MIL-STD  1529  and 
the  UK  military  standard  Def  Stan  00-971.  From  this 
review,  it  was  apparent  that  the  military  specifications 
and  standards  are  generally  more  stringent  than  civil 
requirements.  Some  standards  rely  more  heavily  on 
testing,  including  full-scale  rig  and  engine  testing.  The 
methodology  developed  for  the  Canadian  Forces  is 
largely  derived  from  this  review.  It  incorporates 
Transport  Canada  requirements  for  Design  Approval 
applications,  which  allows  commercial  operators  to  take 
advantage  of  the  methodology. 

The  Canadian  Forces  Methodology  for  LCM  of  Aging 
Engines  is  an  organized  engineering  approach  consisting 
of: 

1)  a  Failure  Mode,  Effects  and  Criticality  Analysis 
(FMECA)  to  establish  the  criticality  of  damage 
found  in  components  and  its  effects  on  aircraft 
performance  and  operation; 

2)  a  Repair  ability  and  Cost  Benefit  Analysis  (RCBA)  to 
establish  whether  damaged  components  should  be 
replaced  or  repaired;  and 

3)  an  Engine  Repair  Structural  Integrity  Program 
(ERSIP)  to  ensure  that  the  parts  to  which  a  life 
extension  process  is  applied  will  remain  airworthy, 
safe  and  reliable  through  the  life  extension. 

The  FMECA  package  developed  for  the  CF  is  a  stand¬ 
alone  reliability  analysis  tool  designed  to  assist  the  CF 
LCMMs  with  engine  maintenance.  The  CF  FMECA 
identifies  potential  failure  modes  of  hardware  and  the 
effects  of  failure  on  system  performance,  reliability  and 
safety.  It  has  been  designed  to  assist  CF  LCMMs  with 
identification  of  root  failure  causes  and  the  development 
of  corrective  actions.  It  also  identifies  durability/safety 
critical  components  requiring  special  management 
approaches  [2]. 

The  Canadian  ERSIP  was  conceived  to  establish 
structural  performance  requirements  and  identify  tests  for 
the  development  and  qualification  of  life  extension 
technologies  [25].  ERSIP  modifies  and  extends  the  limits 
of  MIL-STD-1783  (ENSIP)  to  satisfy  operator’s  needs 
for  the  management  of  components  subjected  to  life 
extension  processes.  It  incorporates  the  damage  tolerance 
approach  implied  by  ENSIP  and  is  used  by  the  CF  to 
establish  structural  performance,  process  development 
and  verification  requirements  that  will  ensure  structural 
integrity  of  components  subjected  to  life  extension.  The 


ultimate  goal  of  ERSIP  is  to  ensure  structural  safety, 
durability,  reduced  life  cycle  cost  and  increased  service 
readiness  of  engines. 

The  application  of  ERSIP  involves  five  generic  tasks,  the 
purposes  of  which  are  summarized  below  [25], 

Task  1:  Original  Design  and  Service  History  Information 
Calls  for  alignment  of  the  proposed  life  extension  scheme 
with  the  original  structural  design  criteria  to  ensure 
operational  needs  and  requirements  are  satisfied  (may 
require  that  some  design  data  be  provided  by  the  OEM). 

Task  II:  Process  Development  and  Design  Modifications 
Calls  for  coupon  level  qualification  and  quality  control 
testing  plans  to  develop  the  life  extension  process  and  any 
design  modifications,  if  applicable. 

Task  III:  Component  Tests 

Calls  for  assessing  the  strength,  damage  tolerance, 
durability  and  dynamic  response  characteristics  of 
components  processed  for  life  extension. 

Task  IV:  Engine  Tests 

Calls  for  verifying  component  performance  in  test  engines 
either  under  simulated  service  conditions  via  an  ASMET, 
or  an  Accelerated  Mission  Test  (AMT)  designed  to 
simulate  the  life  limiting  damage  modes  of  interest  [2],  or 
through  field  testing. 

Task  V:  Life  Management 

Provides  a  plan  for  the  management  of  repaired  engines 
based  on  a  life  extension  interval  (LEI)  greater  or  equal  to 
the  time  between  overhaul  (TBO). 

The  overriding  goal  of  ERSIP  is  to  ensure  that  parts  will 
remain  airworthy,  safe  and  reliable  through  the  life 
extension.  The  technologies  that  are  being  addressed 
through  ERSIP  include: 

•  Restoration  of  damaged  components  to  serviceable 
conditions  (e.g.  by  repair  or  rework)  in  conformity  with 
the  original  requirements,  or  those  of  ERSIP; 

•  Modifications  intended  to  improve  the  structural 
durability  or  damage  tolerance  of  an  engine  component 
(e.g.  a  material  change,  the  addition  of  a  coating  or  use 
of  a  surface  treatment),  in  conformity  with  the 
requirements  of  ERSIP; 

•  Reuse  of  components  under  a  damage  tolerance-based 
life  cycle  management  scheme  to  achieve  life 
extension,  in  conformity  with  the  requirements  of 
ERSIP. 

6.  LIFE  EXTENSION  THROUGH  RESTORATION 
(REPAIRS  AND  REWORKS) 

R&O  manuals  contain  information  on  some  basic  repairs 
that  may  be  applied  at  overhaul  to  allow  damaged 
components  to  be  returned  to  service.  As  engines  mature 
and  service  experience  accumulates,  it  is  not  unusual  to 
find  out  that  some  components  are  incurring  damage  that 
was  not  anticipated  by  the  OEM  and  for  which  no  repair 
procedure  has  been  developed.  Revisions  to  service 
bulletins  and  manuals  for  military  engines  are  issued 
from  time  to  time  by  OEMs  to  introduce  new  repairs  or 
changes  in  design  and  materials  with  a  view  to  addressing 
component  durability  shortcomings.  This  is  most  often 
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done  under  a  Component  Improvement  Program  (CIP). 
However,  the  introduction  of  new  repair  or  rework 
procedures  by  the  OEMs  often  falls  behind  advancements 
in  technology.  The  latter  provide  opportunities  to  create 
new  repairs  or  implement  new  design  or  material 
changes,  such  that  components  experiencing  unforeseen 
deterioration  can  be  returned  to  service,  instead  of  being 
scrapped  [26].  New  technologies  may  also  allow  parts  to 
be  repaired  beyond  the  damage  limits  envisaged  and  set 
by  the  OEM  as  given  in  the  standard  R&O  Manuals. 

Much  work  has  been  done  in  the  commercial  world  to 
develop  repairs  and  reworks  for  civilian  aircraft  engines. 
Repair  vendors  have  been  competing  quite  successfully 
with  OEMs  in  these  developments.  The  delegation  of 
authority  by  National  Aviation  Authorities  to  R&O 
Organizations  has  encouraged  such  initiatives.  The 
technology  developed  for  civilian  products  is  for  the  most 
part  applicable  to  military  platforms  and  can  be  adopted 
by  military  organizations  to  achieve  cost-effective 
management  of  their  engines  [2,26].  The  following  listing 
identifies  types  of  repair/rework  technologies  that  CF 
engine  fleet  managers  have  considered  in  order  to  achieve 
component  life  extension: 

•  New  welding  materials  and  techniques  for  cracked 
and  worn  parts; 

•  Advanced  brazing  or  diffusion  bonding  techniques 
for  cracked  components; 

•  Rejuvenation  of  properties  in  creep  or  fatigue 
damaged  parts  by  HIPing  and/or  heat  treatment;  and 

•  Surface  rebuild  or  re-contouring  for  eroded,  corroded 
or  worn  parts. 

6.1  Advanced  Welding  Repairs 

Welding  technologies  have  long  been  used  to  repair 
cracked  gas  path  components  such  as  vanes  and  blades 
and  combustor  liners.  Procedures  are  well  established  and 
detailed  in  the  engine  R&O  Manuals.  However,  the 
emergence  of  new  techniques  makes  it  possible  to  repair 
components  that  are  not  covered  by  the  standard  manuals 
or  beyond  the  limits  set  by  the  OEM  [1]. 

For  instance,  OAC  has  recently  developed  a  patch  repair 
for  eliminating  FOD  in  F404  fan  and  compressor  blades 
using  electron  beam  welding  (EBW)  [27].  The  damaged 
area  is  replaced  by  a  patch  made  of  the  same  material  as 
the  blade,  which  is  joined  to  the  airfoil  by  EBW.  The 
repaired  assembly  is  then  finished-machined  to  meet 
dimensional  specifications,  Fig  13.  These  blades  have 
been  shown  to  perform  as  well  as  new  blades  in 
qualification  tests  and  will  shortly  be  field-tested  in  a  CF 
engine.  A  similar  process  is  used  at  Pratt  &  Whitney 
Canada  (PWC)  to  repair  airfoils  of  integrally  machined 
titanium  alloy  impellers  and  blisks  [9]. 

The  substantiation  tests  used  to  develop  and  qualify  the 
weld  repaired  fan  blades  included  evaluating  the 
microstructure,  tensile  strength  and  fatigue  properties  of 
welded  test  coupons  as  well  as  comparing  properties  of 
new  original  equipment  with  properties  of  repaired  parts. 
The  comparison  included  vibration  characteristics, 


fatigue  properties  and  impact  resistance  of  the 
components.  The  instrumented  ballistic  test  rig  developed 
to  compare  the  resistance  to  impact  by  a  high  velocity 
projectile  of  new  and  weld  repaired  fan  blades,  is  shown 
in  Fig  14.  The  weld-repaired  components  were  finally 
subjected  to  testing  in  an  engine,  as  part  of  a  CF  F404 
accelerated  mission  test  (AMT)  performed  on  behalf  of 
the  CF  at  IAR.  This  AMT  was  used  to  qualify  the  fan 
blade  repair  as  well  as  several  other  life  extension 
schemes  developed  by  OAC  and  IAR. 


Figure  13.  Repair  of  FODed  F404  fan  blade  by  electron 
beam  welding  a  corner  patch  to  replace  damaged 
portion  of  blade. 


Figure  14  Instrumented  ballistic  test  rig  for 
assessing  resistance  to  impact  by  high  velocity 
projectile  of  EBW  repaired  fan  blades. 

Techniques  such  as  Dabber™  welding  [28],  or  powder 
metallurgy  welding  techniques  [29],  as  well  as  pulsed 
laser  or  plasma  welding  techniques  are  making  it  possible 
to  weld  high  strength  superalloy  components  that  were 
previously  difficult  to  weld.  Automated  welding  systems, 
in  combination  with  laser  or  micro-plasma  power 
sources,  have  allowed  the  application  of  weld  metal 
consistently,  using  extremely  low  heat  input  to  minimize 
effects  on  the  base  material  [10]. 


Figure  15.  Weld  tip  repair  of  DS  Ren6  80  first  stage 
turbine  blade  form  CF  F404  engine  (Courtesy 
Liburdi  Engineering,  Hamilton,  Ontario) 
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The  tip  repair  of  a  F404  directionally  solidified  first  stage 
high-pressure  turbine  (HPT)  blade  is  illustrated  in  Fig. 
15.  Here,  the  tip  oxidation/cracking  damage  was  first 
removed  by  grinding.  The  blade  tip  was  then  rebuilt  by 
vision  assisted  automated  plasma  arc  welding,  using  weld 
material  chosen  to  provide  enhanced  oxidation  resistance 
[10]. 

The  repair  of  worn  seal  teeth  from  rotating  air  seal 
components  is  another  economically  desirable 
refurbishment  procedure.  The  knife-like  circumferential 
seal  teeth  on  the  outer  surface  of  air  seal  components  that 
intrude  into  a  surrounding  abradable  shroud,  are 
susceptible  to  wear  during  service.  The  teeth  also  get 
damaged  during  assembly  and  disassembly  at  overhaul. 
The  tips  of  the  damaged  teeth  are  first  ground  down  and 
then  rebuilt  with  over-lays  of  similar  alloys,  using 
welding  techniques  such  as  Dabber™  [28]  welding  or 
pulsed  laser  or  plasma  torch  welding  [10].  An  example  of 
refurbished  seal  teeth  prior  to  final  machining  to  the 
desired  shape  is  shown  in  Fig.  16. 


Figure  16.  Example  of  seal  teeth  repair  using  the 
Dabber™  technique  (Courtesy  of  Liburdi 
Engineering,  Hamilton,  Ontario). 

Substantiation  tests  and  analysis  for  weld  repair  of 
turbine  hot  section  components  may  be  quite  elaborate. 
For  the  seal  teeth  repair  for  instance,  it  is  necessary  to 
assess  the  risk  of  cracks  initiating  at  imperfection  in  the 
built  up  weld  or  at  the  weld  metal/parent  metal  interface. 
The  presence  of  undetected  cracks  at  these  locations  may 
cause  a  significant  debit  in  LCF  properties  of  the 
component.  Test  results  reported  by  Domas  [28], 
obtained  with  simulated  seal  teeth  specimens,  in 
combination  with  fracture  mechanics  analysis,  provided 
an  insight  into  the  likely  performance  of  repaired 
components,  and  contributed  to  the  establishment  of 
process  capability  and  margins  in  relation  to  specification 
limits. 

6.2  Advanced  Brazing  Repairs 

The  development  of  hydrogen  fluoride  (HF)  based 
cleaning  processes  such  as  the  AFOR-DBR  of  Vac-Aero 
International  or  the  University  of  Dayton  Research 
Institute  (UDRI)  oxide  reduction  process,  in  combination 
with  diffusion  brazing  technology,  has  made  it  possible 
to  repair  previously  unbrazable  nickel  base  superalloys. 
These  processes  rely  on  gaseous  HF  to  remove 


thermodynamically  stable  oxide  from  crack  faces,  thus 
promoting  wetting  and  infiltration  of  the  braze  alloy  by 
capillary  forces  and,  thereby,  creating  a  structurally 
sound  and  durable  joint,  Fig  17  [10,  30]. 


(a)  (b) 


Figure  17.  (a)  INCO  792  compressor  turbine  test 
pieces  in  the  as  received  condition  and  after 
AFOR/DBR  processing  (Courtesy  of  Vac-Aero 
International);  (b)  HF  cleaned  and  braze  repaired 
Rene  80  LPT  nozzle  (Courtesy  of  Orenda 
Aerospace  Corporation). 

The  Liburdi  Engineering  LPM™  joining/cladding  process 
[10]  was  developed  as  a  hybrid  wide  gap  brazing 
technique  that  has  proven  successful  for  the  repair  of 
both  blades  and  vanes.  The  process  enables  a  wide  range 
of  alloys  to  be  used  for  crack  repair  and  surface  buid-up. 
The  damage  is  first  removed  by  grinding  and  a  powder 
metallurgy  putty  of  matching  or  custom  composition  is 
applied  and  diffused  into  the  surface  to  complete  the 
repair  and  achieve  the  desired  mechanical  and 
metallurgical  properties. 


(a)  (b) 


Figure  18.  Hardware  for  thermal  fatigue  testing  of 
NGVs  in  burner  rig:  (a)  and  (b)  specimen  fixture  and 
cooling  arrangement;  (b)  close-up  of  specimens 
mounted  in  fixture;  (c)  fine  wire  thermocouples  spot 
welded  on  air  foils  for  temperature  calibration 

Substantiation  tests  for  repairs  of  turbine  hot  section 
components  would  typically  include  an  evaluation  of  the 
microstructure  and  the  mechanical  properties  (stress 
rupture,  LCF)  of  welded  or  brazed  joints,  using  test 
coupons  designed  to  simulate  joint  geometry  and  loading 
conditions  applicable  to  the  repaired  part.  Rig  tests  would 
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also  be  performed  on  components  to  ensure  for  instance 
that  the  flow  rates  through  internal  cooling  passages  are 
identical  for  new  and  repaired  parts.  The  effective  flow 
area  of  a  nozzle  guide  vane  is  another  parameter  that 
would  have  to  be  checked  for  compliance  to 
specifications.  Other  types  of  rig  tests  may  be  considered 
to  compare  the  durability  and  damage  tolerance  of  new 
and  repaired  parts  under  simulated  service  conditions 
[31].  Finally,  the  repaired  parts  would  be  subjected  to 
engine  testing  and/or  field  evaluation  [2]. 


vanes  to  restore  creep  properties  [1].  HIPing  eliminates 
creep  voids  that  may  have  formed  during  service.  The  re¬ 
coating  heat  treatment  completes  the  rejuvenation. 
HIPing  also  eliminates  casting  porosity,  which  improves 
component  reliability  by  reducing  scatter  in  material 
properties.  HIP  rejuvenation  cycles  have  been  developed 
at  IAR  for  alloy  713C  and  IN  738,  both  of  which  are  used 
in  T56  engines  [32,33],  .  HIPing  can  also  be  used  in 
conjunction  with  other  forms  of  repairs,  for  instance  to 
eliminate  shrinkage  porosity  within  braze  joints  [30]. 


Figure  19.  Crack  growth  rate  data  during  burner  rig 
testing  of  NGVs  repaired  by  two  different  processes 
[31]. 

At  NRC-IAR,  engine  specific  test  hardware  has  been 
developed  for  use  in  a  high  velocity  burner  rig  to 
compare  the  thermal  fatigue  response  of  repaired  NGVs 
when  subjected  to  thermal  cycling  in  high  velocity  gas 
jets  (Mach  0.3  to  0.8).  Elements  of  the  hardware  used  to 
assess  the  durability  and  damage  tolerance  of  repaired 
T56-A15/A14  first  stage  NGVs  are  shown  in  Fig  18.  The 
burner  rig  is  a  Becon  LCS-4B  combustor  fitted  with  an 
exhaust  nozzle  that  simulates  the  geometry  of  the  actual 
nozzle  of  the  engine  combustor.  The  parts  to  be  tested  are 
mounted  in  front  of  this  exhaust  nozzle,  in  a  wheel 
assembly  made  up  of  an  entire  set  of  NGVs,  Fig  18(a). 
During  testing,  the  assembly  is  rotated  back  and  forth  by 
a  pneumatic  actuator  to  alternately  expose  two  sets  of 
tests  components  to  the  rig  hot  gases  and  a  cooling  air  jet 
at  room  temperature.  Internal  cooling  of  the  test 
components  can  be  provided,  if  desired.  For  T56  engines, 
three  NGV  segments  are  tested  simultaneously.  While 
one  set  of  test  components  is  being  heated  in  the  hot  gas 
jet,  the  other  set  is  being  cooled  in  the  air  jet.  The  rotation 
of  the  wheel  assembly  occurs  at  predetermined  time 
intervals  to  ensure  that  steady  state  temperature  is 
achieved  during  both  the  heating  and  cooling  portions  of 
the  cycles.  Hot  gas  temperature  and  rate  of  cooling 
airflow  are  adjusted  to  achieve  component  surface 
temperatures  that  are  close  to  the  operating  temperatures 
of  the  parts.  The  test  is  interrupted  after  predetermined 
numbers  of  thermal  cycles  to  inspect  the  NGVs  for  the 
presence  and  size  of  cracks.  Crack  growth  rate  data 
obtained  for  two  sets  of  T56-A15/A14  first  stage  NGVs 
repaired  by  different  vendors  are  shown  in  Fig  19  [31]. 

6.3  Rejuvenation  by  Heat  Treatments 

Heat  treatments  and  hot  isostatic  pressing  (HIPing)  have 
been  used  for  over  two  decades  to  eliminate  service 
induced  microstructural  damage  in  turbine  blades  and 


The  qualification  of  HIP  rejuvenation  treatments  requires 
that  mechanical  properties  of  rejuvenated  components  be 
established  from  tests  performed  on  specimens  machined 
from  components.  Miniature  creep  specimens  machined 
from  T56  turbine  blades  are  shown  in  Fig.  20(a).  The 
rupture  life  and  creep  elongation  data  shown  in  Fig.  20(b) 
for  new,  service-exposed  and  rejuvenated  IN  738  blades 
indicate  that  loss  of  creep  ductility  induced  by  service  can 
be  fully  recovered  by  HIP  rejuvenation,  while  time  to 
rupture  relative  to  new  blades  can  actually  be  improved, 
providing  post  HIP  heat  treatments  are  carefully  designed 
[33]. 


a* 


Figure  20  (a)  Miniature  creep  specimens  machined 
from  the  airfoils  of  different  T56  turbine  blades;  (b) 
Comparison  of  rupture  life  and  creep  elongation  of 
new,  service-exposed  and  HIP  rejuvenated  blades 
showing  influence  of  HIP  cycle  and  improvements 
of  properties  achieved  with  cycle  #3  [13,31] 

6.4  Re-contouring  of  Compressor  Airfoils 

Processes  such  as  Sermatech’s  RD-305  or 
Lufthansa/University  of  Aachen’s  ARP  can  be  used  to 
recover  the  loss  in  aerodynamic  performance  of  eroded 
compressor  airfoils.  With  these  processes,  the  leading 
edge  of  eroded  airfoils  is  re-machined  by  grinding  to  a 
new  optimized  contour  geometry  designed  to  meet  the 
flow  condition  characteristics  of  the  original  blading.  The 
design  criteria  are  chord  length,  profile  thickness  and 
leading  edge  angle.  Re-contouring  is  limited  to  blades  for 
which  the  chord  length  is  greater  that  the  OEM  specified 
minimum  allowable,  and  therefore  the  components  are 
deemed  reusable.  Re-contouring  translates  into  increased 
compressor  efficiency,  reduced  fuel  consumption, 
extended  on-wing  times  and  reduced  spare  parts  costs 
[34]. 

7.  LIFE  EXTENSION  THROUGH  MATERIALS 
MODIFICATIONS 

The  options  available  to  enhance  component  durability 
through  materials  modifications  include: 

•  Substituting  a  component  material  for  another,  such 
as  replacing  a  blade  alloy  from  a  conventionally  cast 
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form  to  a  DS  product  (CG  or  SC)  to  increase  the 
component  creep  strength  or  its  thermal  fatigue  (TF) 
resistance; 

•  Replacing  or  adding  a  protective  coating  to  improve 
resistance  to  wear,  fretting,  erosion,  oxidation  or 
corrosion  ,  such  as  hard  coatings  to  protect 
compressor  airfoils  against  erosion  or  a  TBC  for  hot 
parts;  and 

•  Applying  a  surface  modification  treatment  such  as 
shot  peening,  ion  implantation  or  laser  surface 
treatments  to  improve  resistance  to  various  modes  of 
surface  degradation  or  fatigue. 

7.1  Retrofitting  with  New  Materials 

The  decision  to  change  a  component  material  is  normally 
made  during  a  component  improvement  program  led  by 
the  engine  manufacturer  but  supported  by  different  user 
services.  There  are  examples  of  material  changes 
involving  both  blades  and  discs.  For  CF  F404  engines, 
the  first  stage  HPT  blade  material  was  changed  from  CC 
Rene  125  to  DS-CG  Rene  80  and,  recently,  a  change  to 
SC  alloy  N4  has  been  approved.  This  was  done  to 
improve  the  creep  strength  and  thermal  fatigue  resistance 
of  the  blades.  However,  with  changes  of  this  type,  the 
expected  improvements  are  not  always  met,  because  a 
different  mode  of  damage  that  was  not  anticipated  may 
prove  to  be  life  limiting.  Disc  alloys  are  more  rarely 
changed.  Any  change  would  be  made  to  correct  a 
durability  shortcoming.  For  example,  one  of  the  CF  J85 
CAN40/15  engine  compressor  disc  was  changed  from 
AM355  martensitic  stainless  steel  Fig.  9(b)  to  a  DA718 
nickel  base  superalloy  to  eliminate  premature  bolt  hole 
cracking. 

7.2  Replacing  or  Adding  a  Protective  Coating 

Both  the  substitution  and  the  addition  of  coatings  provide 
opportunities  for  life  extension  of  cold  end  as  well  as  hot 
end  components.  The  qualification  testing  would 
typically  involve  documentation  of  the  physical  and 
mechanical  properties  of  the  new  coating  as  well  as 
evaluation  of  relevant  durability  and  damage  tolerance 
properties.  More  importantly,  coating-substrate 
interactions  and  their  impact  on  component  properties 
would  have  to  be  carefully  assessed. 

7.2. 1  Hard  Coatings  for  Compressor  Airfoils 
Titanium  nitride  (TiN)  has  been  qualified  as  a  coating  for 
the  protection  of  compressor  airfoils  against  damage  due 
to  erosion  and  corrosion.  In  particular,  the  RIC™  PVD 
TiN  coating  from  Liburdi  Engineering  is  a  bill-of 
material  option  for  T56/K501  RR(Allison)  engines  [10]. 
Titanium  nitride  is  a  hard  ceramic  compound,  which 
provides  excellent  protection  against  erosion  and  some 
corrosion  protection,  although  pitting  may  be  a  problem 
with  some  commercial  TiN  coatings.  The  latest 
generation  of  coatings  are  designed  to  improve  both 
erosion  and  corrosion  resistance.  These  new  coatings  are 
based  on  alloying  TiN  with  carbon  or  aluminum  (TiCN, 
TiAIN).  Coatings  based  on  chromium  nitride  are  also 
being  considered  for  corrosion  protection  [5]. 


Substantiation  testing  for  compressor  coatings  will 
typically  involve  measurements  of  coating  thickness, 
uniformity  and  surface  finish,  assessment  of  coating 
durability  (adhesion,  hardness,  ductility  and  toughness, 
erosion  resistance,  corrosion  resistance).  The  effects  of 
coating  on  substrate  microstructure  and  mechanical 
properties  (strength,  fatigue),  on  vibration  characteristics 
and  fatigue  properties  of  coated  components,  and  on 
compressor  efficiency  and  engine  performance  would 
also  be  considered  [5,31].  A  sand  ingestion  test  may  be 
conducted  inside  a  test  cell.  However,  because  such 
testing  may  not  accurately  simulate  real  operating 
conditions,  a  field  evaluation  is  usually  preferred. 

Coatings  can  significantly  alter  the  natural  frequencies  of 
compressor  airfoils.  The  change  may  be  sufficient  to 
cause  the  airfoils  to  be  excited  at  resonant  frequencies 
during  service  and  such  vibration  may  lead  to  high-cycle 
fatigue  (HCF)  failure.  The  effect  of  coatings  on  the 
fatigue  life  of  the  component  is  another  important 
consideration  of  the  qualification  process.  Substantiation 
test  hardware  developed  at  IAR  to  assess  the  effects  of 
coating  on  fatigue  properties  of  T56  6th  stage  compressor 
blades  is  shown  in  Fig.  21(a)  [31]. 


(a) 


WE1BULL  ANALYSIS 
90  ksi 


Figure  21.  (a)  Apparutus  for  measuring  natural 
frequencies  of  fatigue  properties  in  first  bending 
mode  vibration  of  6*  stage  T56  compressor  blades; 
(b)  Weibull  distribution  plot  of  fatigue  life  of  the 
coated  and  uncoated  blades  measured  with  the 
apparatus  [5]. 
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The  blade  is  attached  by  its  dovetail  to  a  fixture  mounted 
on  an  electromagnetic  shaker  and  made  to  vibrate  at  its 
natural  frequency  in  the  first  bending  mode,  until  failure 
occurs.  The  number  of  cycles  to  failure  of  coated  blades 
is  compared  with  that  for  bare  blades  at  identical  root 
stress  levels.  Weibull  analysis  of  the  fatigue  test  results 
for  RIC  coated  blades  indicates  that  the  cumulative 
probability  of  failure  for  the  coated  blades  is  significantly 
smaller  at  90  ksi  than  for  the  uncoated  blades,  Fig.  21(b) 
[31].  The  S/N  data  obtained  by  rotating  bending  fatigue 
also  indicate  that  RIC  coated  test  coupons  of  the  blade 
material  (17-4PH  stainless  steel)  have  fatigue  lives 
comparable  or  better  than  those  of  bare  coupons  [5].  The 
increase  in  fatigue  life  may  be  due  to  changes  in  the 
blade  microstructure  induced  by  the  coating  process  or  to 
the  residual  compressive  stresses  induced  by  the  coating 
on  the  surface  of  the  blades. 

7.2.2  Coatings  for  Turbine  Hot  Section  Components 
It  is  common  practice  to  re-coat  turbine  blades  and  vanes 
at  overhaul.  This  provides  an  opportunity  to  change  the 
coating  for  one  that  is  better  suited  for  the  operating 
environment.  For  instance,  a  Pt-aluminide  will  provide 
some  durability  enhancement  over  conventional 

aluminides  where  hot  corrosion  is  found  to  be  life- 
limiting.  Also,  the  addition  of  a  thermal  barrier  coating 
(TBC)  to  some  critical  areas  of  an  airfoil,  such  as  the  tip 
region  of  turbine  blades  or  leading  edge  of  an  NGV,  will 
lower  component  metal  temperature  and  minimize  the 
rate  of  material  consumption  due  to  oxidation  at  these 
locations  [2].  TBCs  will  also  reduce  the  sensitivity  of 
these  components  to  thermal  fatigue  cracking  by 
decreasing  the  transient  stresses  induced  by  thermal 
cycling  during  service  [2]. 

Coatings  can  also  be  added  to  components  that  have  been 
designed  to  operate  without  a  protective  coating.  This  is 
the  case  for  the  F404  turbine  nozzle.  Rapid  oxidation  of 
the  airfoil  surface  of  this  component  gives  rise  to  loss  of 
material  through  spallation  and  thermal  fatigue  cracking 
near  cooling  holes.  OAC  has  developed  a  braze  repair  for 
the  cracks  and  a  repair-compatible  coating  for  the  airfoil 
that  has  been  shown  to  greatly  enhance  component 
durability  in  accelerated  burner  rig  tests  [2,35]. 

Substantiation  testing  to  qualify  new  protective  coatings 
for  turbine  hot  gas  path  components  will  typically 
involve  a  metal  lographic  evaluation  of  coating 
microstructure  to  evaluate  quality  of  the  coating  and  its 
impact  on  microstructure  and  phase  stability  of  the 
substrate  material.  An  assessment  of  the  effects  of 
coating  on  the  mechanical  properties  of  coated  material 
test  coupons  (Tensile  and  creep  strength,  HCF  LCF, 
thermal  mechanical  fatigue  (TMF),  ductile-brittle 
transition  temperature  (DBTT),  etc.)  is  another  important 
requirement.  Rig  tests  are  required  to  ensure  that  the  flow 
rates  across  cooling  passages  of  internally  cooled  parts 
are  identical  for  original  and  modified  parts.  Rig  tests  are 
also  required  to  compare  the  durability  and  damage 
tolerance  of  original  and  modified  parts,  under  simulated 
service  conditions.  Engine  testing  as  part  of  an 
accelerated  mission  test  (AMT)  will  complete  the 
qualification.  The  IAR  burner  rig  is  used  to  assess  the 


durability  of  modified  components  as  well  as  to  screen 
candidate  coatings  applied  to  test  coupons  in  the  form  of 
pins  or  plates,  depending  on  the  type  of  coating  and 
intended  applications  [31]. 


(a)  (b) 

Figure  22.  (a)  Tensile  coupons  and  (b)  IAR  fretting 
fatigue  test  rig  for  assessment  of  fretting  fatigue 
resistance  of  fan  engine  materials  [31]. 


Figure  23.  The  fretting  fatigue  life  of  Ti-6AI-4V: 
a  =  base  metal;  b  =  CuNiln  +  MoS2;  c  =  shot 
peened;  d  =  shot  peened  +  CuNiln  +  MoS2;  e  =  shot 
peened  +  MoS2. 

7.3  Surface  Modification  Treatments 

Surface  treatments  such  as  ion  implantation  and  chemical 
surface  treatments  have  been  explored  for  use  in 
conjunction  with  shot  peening  and  soft  coatings  to 
alleviate  the  fretting  fatigue  problems  in  the  dovetails 
areas  of  titanium  alloy  fan  and  compressor  blades.  Shot 
peening  in  combination  with  chemical  treatments  has 
been  found  to  be  quite  effective  in  laboratory  tests  but 
other  surface  treatments,  including  soft  coatings  and 
lubricants,  appear  to  also  have  the  potential  to  improve 
fretting  fatigue  resistance  of  titanium  alloys.  The  effects 
of  these  treatments  on  fretting  fatigue  life  of  two  titanium 
alloys  (Ti64  and  Til 7)  have  been  evaluated  using  an 
apparatus  developed  at  IAR,  Fig.  22.  Some  of  the  results 
of  this  work  are  presented  in  Fig.  23  (36,37). 

8.  LIFE  EXTENSION  OF  SAFETY-CRITITCAL 
PARTS  THROUGH  IMPLEMENTATION  OF  NEW 
LCM  METHODOLOGIES 

The  main  factors  considered  in  the  choice  of  materials  for 
compressor  and  turbine  discs  in  engines  developed  in  the 
50’s  and  60’s  were  tensile  properties  in  the  bore  and  the 
rim  of  the  discs  and  creep  properties  in  the  rim  of  turbine 
discs.  This  was  done  essentially  to  provide  an  overspeed 
margin  without  disc  burst.  For  engines  of  that  generation, 
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fatigue  lives  were  not  provided  for  safety-critical  parts 
[38].  On  occasion,  LCF  lives  of  turbine  rotors  have  been 
established  by  OEMs  at  a  late  stage  in  the  life  of  an  aging 
engine,  usually  under  a  component  improvement  program 

(C1P). 

For  a  number  of  such  undertakings,  the  actual  service 
lives  of  a  significant  fraction  of  components  from  lead- 
the-fleet  engines  have  been  found  to  be  greater  than  the 
calculated  LCF  safe  lives.  This  reinforces  the  view  that 
components  retired  at  their  design  safe-life  limits  may 
have  significant  fractions  of  usable  life  remaining.  This  is 
the  case  for  an  engine  operated  by  the  Canadian  Forces. 
In  another  situation  affecting  the  Canadian  Forces,  the 
engine  was  old  enough  that  replacement  discs  and 
impellers  were  not  available.  In  situations  of  this  type,  the 
implementation  of  a  damage  tolerance  approach  can 
assist  fleet  managers  minimize  risk  if  they  must  keep  the 
engines  in  service. 


Table  1  CF  engine  components  targeted  for  life 
management  based  on  RFC  concepts  and  status  of 
the  analyses. 


Engine 

Component 

Status 

Nene  X 

Impeller 

Complete 

Turbine  disc 

Complete 

Turbine  shaft 

In  progress 

J85 

Compressor  Disc 

Complete 

Turbine  disc  assembly 

In  progress 

T56 

Turbine  spacer 

In  progress 

Implementation  of  a  damage  tolerance  based  LCM 
approach  for  safety  critical  parts  is  best  undertaken  by  the 
OEM,  for  instance  under  CIP  sponsorship.  However, 
there  may  be  situations  where  this  is  not  possible,  either 
because  CIP  sponsorship  is  not  an  option  or  the  OEM  is 
not  prepared  to  undertake  the  required  work..  In  this  case, 
there  may  be  no  alternative  but  for  the  user  to  undertake 
the  implementation. 

In  Canada,  components  from  three  CF  engines  have  been 
targeted  for  implementation  of  a  damage  tolerance/RFC 
based  LCM  approach.  The  components  are  from  Nene  X, 
T56  and  J85  engines  and  they  are  identified  in  Table  1, 
along  with  the  status  of  the  undertakings. 

Implementation  of  a  damage  tolerance  based  LCM 
methodology  for  aging  components  requires  information 
on  (i)  initial  crack  length,  (ii)  changes  in  stress  intensity 
factor  (SIF)  with  crack  extension,  (iii)  fatigue  crack 
growth  rates  (FCGR)  at  the  fracture  critical  location  in 
the  component,  (iv)  dysfunction  crack  size  (DCS)  and  (v) 
cyclic  and/or  steady  state  service  usage  of  the  engine. 
This  information  is  needed  to  predict  a  fracture 
mechanics  based  safe  inspection  interval  under  typical 
service  conditions.  There  are  seven  steps  that  would 
normally  be  followed  to  obtain  or  generate  the  required 
information  and  to  conduct  and  validate  the  analyses. 

The  seven  steps  include: 


•  Determination  of  stress  and  temperature  data  for  the 
component  of  interest; 

•  Identification  of  the  fracture  critical  location  in  the 
component; 

•  Determination  of  the  stress  intensity  factor  (SIF)  of 
cracks  at  the  fracture  critical  location  and  its 
dependence  on  crack  size  and  estimation  of  the 
dysfunction  crack  size  (DCS); 

•  Generation  of  fracture  mechanics  data  for  safe 
inspection  interval  (SII)  calculations 

•  Generation  of  POD  data  for  the  NDI  technique  used 
at  depot  level  to  inspect  the  component  (to  provide 
estimate  for  initial  crack  size); 

•  Calculations  of  the  safe  inspection  interval  (SII);  and 

•  Full  scale  testing  in  a  spin  rig  to  validate  the  SIIs. 

Examples  taken  from  CF  experience  for  each  of  the  steps 
are  presented  below. 

Step  1:  Determination  of  Engine  Stress  and 
Temperature  Data 

Mechanical  stresses  can  be  calculated  from  rotational 
speed,  geometry  and  mass  of  the  component.  However, 
predicting  thermal  stresses  requires  detailed  information 
on  temperature  transients  and  temperature  maxima, 
which  are  more  difficult  to  obtain.  This  information  is 
strongly  influenced  by  service  usage  and  may  not  be 
available  from  the  engine  manufacturer.  For  the  J85 
turbine  disc  assembly,  work  is  underway  at  IAR  to 
generate  the  information  under  the  auspices  of  a  TTCP 
project.  A  turbine  assembly  has  been  instrumented  to 
determine  the  temperature  distribution  across  the 
components.  An  engine  has  also  been  equipped  with  a 
slip  ring  to  transmit  the  information  collected  from 
sensors  to  instrumentation  located  outside  the  engine.  A 
photograph  of  the  modified  engine  is  shown  in  Fig.  24. 
The  results  of  this  study  will  be  used  to  set  boundary 
conditions  in  FEM  models  to  establish  temperature  and 
stress  distribution  within  the  turbine  assembly. 


Figure  24.  Back  end  of  J85  CAN40  engine  with  slip 
rig  installed  to  transmit  sensor  information  to  an 
outside  data  acquisition  system. 

Step  2:  Identification  of  the  Fracture  Critical 
Location 

This  is  obtained  by  analysis  using  the  finite  element 
method  (FEM).  For  Nene  X  components,  the  thermal- 
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mechanical  loading  information  required  as  boundary 
conditions  was  discussed  with  the  engine  manufacturer. 
Both  2-D  and  3-D  analyses  were  performed  for  the 
turbine  disc.  The  bottom  serration  of  the  firtree  slots  in 
the  disc  was  identified  as  the  fracture  critical  location 
because  of  a  combination  of  high  thermal  and  mechanical 
stresses  operative  at  this  location  [39].  The  distribution 
in  von  Misses  stress  between  two  of  the  disc  slots  is 
shown  in  Fig.  25  for  the  2-D  analysis  case. 


of  the  fracture  toughness  ( Klc )  of  the  material.  That  crack 
depth  magnitude  of  8  mm  was  used  in  all  subsequent 
calculations  to  arrive  at  the  SII  for  this  component. 
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Figure  27.  Stress  intensity  factor  (SIF),  as  a  function 
of  crack  depth  for  a  crack  with  a  2c/a  ratio  of  4.5:1 
located  in  the  bottom  serration  of  the  firtree  slot  in 
the  Nene  X  disc  [40]. 


Figure  25.  Details  of  the  2D  stress  distribution  for 
the  rim  region  of  the  Nene  X  turbine  disc  in  an 
uncracked  condition 


Figure  26.  Details  of  the  3D  strain  distribution  for  the 
rim  region  of  the  disc  with  a  modeled  crack  in  the 
bottom  serration  of  the  firtree  slot,  which  is  the 
primary  fracture  critical  location  in  the  disc  [39]. 

Step  3:  Fracture  Mechanics  Analysis  for  SIF 
Calculations 

This  is  also  obtained  analytically  using  the  FEM.  For  the 
case  of  the  Nene  X  turbine  disc,  a  crack  was  assumed  to 
be  present  in  the  bottom  serration  region  of  the  firtree 
slot,  as  shown  in  Fig.  26.  The  fracture  mechanics  analysis 
was  performed  for  cracks  with  surface  length  to  depth 
ratios  (2c/a)  of  3:1  and  4.5:1.  A  2c/a  ratio  of  3:1  is  often 
observed  in  aero  engine  discs.  A  2c/a  ratio  of  4:1  is 
considered  to  represent  a  worst  case  situation,  whereas  a 
2c/a  ratio  of  4.5:1  represents  a  multiple  crack  situation 
[39].  Variation  of  the  stress  intensity  factor  (SIF)  with 
crack  depth  for  a  crack  with  a  2c/a  ratio  of  4.5:1  is  shown 
in  Fig.  27  [40].  For  a  crack  8  mm  deep,  the  SIF  value 
ahead  of  the  crack  tip  is  64  MPA  m1/2,  which  is  a  fraction 


Figure  28.  Tensile  and  compact  tension  specimens 
machined  from  the  Nene  X  disc.  The  eletrical  leads 
are  part  of  the  automated  DC-PD  technique  used  to 
monitor  crack  growth  during  testing. 

Step  4:  Generation  of  Fracture  Mechanics  Data 

The  fatigue  crack  growth  rate  (FCGR)  data  versus  stress 
intensity  range,  AK,  is  preferably  generated  using 
compact  tension  specimens  machined  from  a  high  time 
component  as  close  as  possible  to  the  fracture-critical 
location,  Fig.  28.  A  high  time  component  is  selected  to 
account  for  any  effects  of  service-induced  microstructural 
degradation  on  crack  growth.  The  test  temperature  is 
chosen  on  the  basis  of  service  temperature  estimates  for 
the  fracture  critical  location.  The  specimen  geometry 
should  conform  to  ASTM  E-647  specifications  to  ensure 
that  plane  strain  conditions  prevail  ahead  of  the  crack  tip 
during  testing.  The  FCGR  data  reproduced  in  Fig.  29 
reveals  that  material  machined  from  a  high  time  IN  718 
disc  has  significantly  higher  FCGRs  than  material 
machined  from  a  new  or  a  medium  time  disc  (41).  Such 
variations  in  FCGR  data  would  significantly  influence 
SII  calculations.  The  worst  case  scenario  would  normally 
be  adopted  for  the  calculations  [42,43]. 
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Figure  29.  Comparison  of  fatigure  crack  growth 
rates  (FCGR)  in  new  and  service  exposed  alloy  718 
turbine  discs;  high  time  disc  shows  significantly 
higher  FCGR  as  compared  to  new  and  medium  time 
disc  [41]. 


Figure  30.  Probability  of  detection  of  natural  cracks 
in  Fe-Ni-Cr  alloy  turbine  discs  using  liquid 
penetrant  inspection  (LPI),  eddy  current  inspection 
(ECI)  and  x-ray  inspection  (XRI)  [44,45]. 

Step  5:  Generation  of  POD  Data  for  the  NDI  Method 
of  Interest 

The  size  of  cracks  likely  to  be  missed  during  component 
inspection  needs  to  be  estimated  to  predict  SIIs.  Ideally, 
enough  data  should  be  generated  to  obtain  probability  of 
detection  (POD)  curves  specifically  for  the  component  of 
interest  and  the  method  used  for  its  inspection.  This  may 
not  always  be  possible.  The  initial  crack  size  (a \  in  Fig. 
11)  for  components  targeted  by  the  CF  have  been 
selected  from  a  demonstration  program  carried  out  in 
Canada  on  a  series  of  J85  life  expired  compressor  discs 
containing  natural  fatigue  cracks  originating  from  bolt 
holes  [16].  For  this  program,  several  discs  were  inspected 
by  a  variety  of  NDI  methods  and  by  different  inspectors. 
The  NDI  results  were  verified  by  prying  open  each  bolt 
hole  inspected  and  examining  the  fracture  surface  for 
evidence  of  service  induced  cracking.  Actual  flaw  sizes 
were  established  from  the  microscopic  examinations. 
Finally,  POD  data  for  each  of  the  NDI  methods 
considered  was  generated  through  standard  POD 
analysis.  This  program  was  first  introduced  to  the 
AGARD  community  in  1988  as  part  of  a  Workshop  on 
Non  Destructive  Evaluation  [44].  A  follow-up  AGARD 
sponsored  activity  broadened  the  scope  of  the  study  for 
the  benefit  of  the  NATO  community  [45].  The  substantial 
data  on  POD  of  NDI  methods  generated  through  this 
effort  are  available  from  the  USAF  supported 


Nondestructive  Testing  Information  Analysis  Center 
(NTIAC)  in  Austin,  Texas.  The  POD  curves  for  three 
common  inspection  techniques,  including  liquid 
penetrant  inspection  (LPI),  are  compared  in  Fig.  30. 

For  the  Nene  X  turbine  disc,  the  initial  flaw  size  was 
assumed  to  correspond  to  either  the  maximum  crack 
length  missed  (amax)  or  the  crack  length  value  at  90% 
POD  with  95%  confidence  (90/95  POD)  obtained  for  LPI 
under  the  J85  disc  program.  This  is  justified  since  LPI  is 
used  to  inspect  Nene  X  components  and  the  two  discs  are 
made  of  stainless  steel  [40]. 

Step  6:  Calculation  of  SII 

The  SII  is  set  as  a  fraction  of  the  time  it  takes  to  grow  a 
crack  of  assumed  geometry  from  the  initial  crack  size  to 
the  dysfunction  crack  size.  Either  deterministic  or 
probabilistic  fracture  mechanics  (DFM  or  PFM)  analyses 
can  be  used  to  compute  the  SII.  A  DFM  analysis  is  based 
on  worst  case  situations  for  all  variables  in  the  life 
calculations.  Many  have  claimed  DFM  to  be  overly 
conservative  and  this  explains  the  growing  interest  in 
PFM  based  analyses.  A  PFM  analysis  aims  primarily  to 
simulate  the  consequences  of  missing  a  crack  during 
inspection  (42,43).  It  also  helps  account  for  scatter  in 
FCGR  data. 
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Figure  31.  Lognormal  analysis  of  PFM  generated 
data  for  Nene  X  turbine  discs  simulating  the  effect 
of  worst  possible  scatter  in  FCGR  data  and 
uncertainties  associated  with  the  LPI  technique  [40], 

A  lognormal  analysis  of  PFM  data  generated  for  the 
Nene  X  turbine  disc,  which  simulates  the  effect  of  worst 
possible  scatter  in  FCGR  and  uncertainties  associated 
with  the  LPI  technique  is  presented  in  Fig  3 1 .  The  data 
reveal  that  the  0.1%  probability  of  failure  or  1  in  1000 
chance  that  a  missed  crack  will  reach  dysfunction  size  is 
of  the  order  of  26,000  cycles.  Assuming  the  worst  case 
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scenario  of  5  cycles  per  hour  of  engine  usage,  the  0.1% 
probability  of  failure  translates  into  5000  hours.  Since  the 
engine  is  currently  inspected  every  1800  hours,  it  is  not 
surprising  that  no  components  have  ever  failed 
catastrophically  in  service.  Interpretation  of  PFM 
analysis  simulating  experimentally  observed  scatter  in 
FCGR  data  indicates  that  the  overall  safety  factor 
inherent  in  the  predicted  SII  for  the  fleet  size  is  4.7  [40]. 

Final  decisions  about  setting  SIIs  for  the  Nene  X  disc 
were  made  on  the  basis  of  a  DFM  analysis.  A  worst  case 
crack  propagation  curve  (depth  versus  cycles)  for  a  crack 
1  mm  deep  originating  from  the  fracture  critical  location 
and  growing  to  a  DSC  depth  of  8  mm  is  shown  in  Fig. 
32.  The  data  clearly  demonstrate  the  importance  of  the 
sensitivity  of  the  NDI  technique  on  the  SII.  For  instance, 
if  the  initial  crack  depth  is  1  mm  the  crack  propagation 
interval  (CPI)  is  about  30,000  cycle,  whereas  it  reduces 
to  about  8,000  cycles  if  the  detectable  crack  depth  is  only 
is  4  mm.  The  SII  recommended  for  the  Nene  X  disc  is 
1/3  of  the  CPI,  or  10,000  cycles.  For  the  worst  case 
scenario  of  5  cycles  per  hour  of  engine  usage,  the  DFM 
based  SII  expressed  in  flying  hours  is  2000  hours. 
Therefore,  there  is  high  probability  that  any  crack  would 
be  detected  during  routine  overhaul  inspection,  since  the 
routine  inspection  for  this  engine  is  conducted  every 
1800  hours  [40]. 

Crack  Growth  in  the  Nene  X  Disc 


Deterministic  Fracture  Mechanics 


Figure  32.  Damage  tolerance  based  life  cycle 
management  curve  for  Nene  X  turbine  discs  using 
90/95  POD  value  of  the  LPI  tehnique  as  the 
detection  limit  of  the  technique  [40] 

Step  7:  Validation  of  SIIs  Through  Spin  Rig  Testing 

Validation  of  the  SII  calculations  requires  spin  rig  testing 
of  components  under  conditions  that  simulate  service. 
Testing  of  J85  and  Nene  X  components  is  underway  at 
IAR  to  validate  component  lives  and  safe  inspection 
interval  calculations  using  the  spin  rig  facility  shown  in 
Fig  33.  To  date  9,000  mission  cycles  have  been 
accumulated  on  the  J85  turbine  disc  assembly  at  a  test 
temperature  of  450°C.  Both  LPI  and  eddy  current 
inspection  techniques  are  being  used  to  inspect  the 
components  as  the  cycles  accumulate. 

All  above  predictions  are  based  on  the  assumption  that 
cyclic  usage  was  the  primary  driver  for  crack  initiation 


and  growth  processes  in  the  Nene  X  disc.  This 
assumption  was  made  on  the  basis  of  discussions  with  the 
OEM,  from  which  it  was  also  concluded  that  time 
dependent  creep  mechanisms  did  not  contribute  to  the 
crack  growth  process  to  any  significant  degree  during 
service.  Based  on  past  experience  with  the  fatigue 
response  of  turbine  disc  materials,  it  was  also  assumed 
that  LEFM  could  be  used  to  describe  crack  growth  within 
the  component.  Had  creep  contributed  to  the 
accumulation  of  damage  in  any  significant  way,  creep- 
fatigue  interactions  would  have  had  to  be  considered. 


Figure  33.  J85  turbine  disc  assemble  being  readied 
fortesting  in  IAR  spin  rig. 

CONCLUDING  REMARKS 

Aging  in  engines  is  a  process  involving  gradual 
deterioration  of  components,  which  begins  when  an 
engine  enters  service.  This  aging  process  cannot  be 
avoided  and  must  be  managed.  Managing  the  aging  of 
engine  components  to  extract  maximum  usage  of 
expensive  to  replace  components  requires  a  good 
understanding  of  deterioration  modes  and  their  effects  on 
engine  performance,  reliability  and  safety.  From  an 
operator’s  perspective,  a  number  of  options  are  available 
to  extend  component  lives  beyond  book  limits.  The 
options  include  taking  advantage  of  technology 
developments  to  repair  damaged  components  or  enhance 
their  durability  through  material  modifications,  including 
the  substitution  or  addition  of  protective  coatings.  The 
implementation  of  a  damage  tolerance  based  life  cycle 
management  methodology  for  safety-critical  parts  may 
also  be  a  practical  option  in  some  situations.  The 
Canadian  experience  suggests  that  significant  cost 
savings  may  accrue  from  such  undertakings  [21]. 
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AGING  AVIONICS-  A  SCIENCE  &  TECHNOLOGY  CHALLENGE  OR 

ACQUISITION  CHALLENGE? 

John  Ostgaard,  Juan  Carbonell,  Stephen  Benning 
AFRL/IFSC 
2241  Avionics  Circle 

Wright-Patterson  Air  Force  Base,  Ohio,  45433-7334,  USA 


The  fleet  of  aircraft  which  we  have  today, 
represents  90%  of  the  aircraft  which  we  will  have 
well  into  the  next  century.  With  defense  budgets 
shrinking,  fewer  new  aircraft  will  be  purchased. 
Avionics  modernization  is  the  highest  leveraged 
approach  to  maintain  and  increase  capability.  This 
treatise  discusses  the  problems  associated  with  our 
existing  fleet  of  aircraft,  both  from  a  maintenance 
and  modernization  perspective.  Examples  of 
obsolescence  and  retrofit  issues  are  provided  to 
highlight  the  seriousness  of  the  problem. 

The  science  and  technology  challenges 
are  the  focus  of  a  small  set  of  technologies  aimed 
at  reducing  the  cost  of  our  aging  systems.  These 
costs  include  maintenance  as  well  as  upgrade 
costs.  Aging  systems  are  different  from  new 
systems  because  there  is  an  existing  infrastructure. 
It  is  much  easier  to  start  from  “scratch”  than 
modify  something  already  in  existence.  Specific 
technology  areas  that  will  be  discussed  include: 

a.  Avionics  software 

b.  Group  A  Modification 

c.  Avionics  Maintenance 

d.  Application  of  COTS  products 

e.  Obsolescence/Environment  for  Rapid 
Design  Changes 

Acquisition  related  issues  have  to  be 
addressed  in  consonance  with  the  Science  and 
Technology  challenges.  Issues  that  will  be 
discussed  include:  Open  systems,  planned 
technology  insertion/planned  obsolescence, 
verification/validation,  warranties/repair  strategies 
and  organic/contractor  support.  As  part  of  this 
acquisition  discussion,  industry  pursuit  of  a 
product  line  investment  strategy  will  be  addressed 
as  their  adoption  of  best  commercial  practices 
continues. 


A  possible  Avionics  S&T  strategy  will  be 
discussed  which  outlines  an  approach  for  infusion 
and  transition  of  advanced  technologies  into  the 
existing  fleet  given  an  acquisition  friendly 
environment.  Discussion  on  modeling,  simulation, 
and  prototyping  will  be  provided  to  further 
explain  the  fleet  wide  application  of  these 
technologies. 

Background 

Today  DoD  is  being  challenged  to  do 
more  with  less.  This  has  focused  attention  on 
affordability  opportunities  and  challenges  with 
emphasis  on  commercial  or  commercial-based 
avionics  and  electronics.  The  life  of  older 
(legacy)  aircraft  is  being  extended  while  their 
avionics  systems  are  becoming  obsolete,  and  more 
difficult  and  expensive  to  maintain  and  support. 
New  aircraft  also  need  to  be  more  affordable  and 
have  functionality  and  performance  equal  to  or 
exceeding  that  of  existing  systems.  Lower 
upgrade  and  support  costs  for  existing  aircraft  and 
lower  acquisition  and  support  costs  for  next 
generation  avionics  systems,  are  primary 
challenges. 

Our  Nation’s  aircraft  are  capable,  but 
their  electronics  are  old  and  aging  rapidly.  In  the 
post  2000  era,  these  aircraft  will  experience 
worldwide  deployment  in  support  of  our  active 
front-line  forces.  The  majority  of  our  Nation’s 
fleet  of  aircraft  through  2020  will  be  legacy 
aircraft  as  shown  in  Figure  1 . 

The  tactical  fighter  fleet  is  aging  rapidly 
in  large  numbers,  with  the  projected  average  age 
of  all  fighters  in  the  USAF  and  Navy  inventories 
estimated  to  be  over  20  years  by  the  year  2020. 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “Aging  Engines,  Avionics,  Subsystems  and  Helicopters”, 
held  in  Atlantic  City,  USA,  23-24  October  2000;  Madrid,  Spain,  26-27  October  2000,  and  published  in  RTO  EN-14. 
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Figure  1  Tactical  Fighter  Inventory 


Clearly,  avionics  on  these  aircraft  will 
require  modernization  during  the  next  decade  if 
these  weapon  systems  are  to  maintain  their 
readiness  status.  Future  aircraft  modernization 
will  focus  increased  capabilities  which  require 
effective  communication  with  active  forces, 
concurrent  use  of  weapons,  compatibility  with 
electronic  combat  systems,  up-to-the-minute 
access  to  off-board  intelligence,  an  effective 
means  of  cooperative  targeting,  high  accuracy 
bombing  with  inertial  guided  weapons,  and  on¬ 
board  training  for  pilots  and  ground  personnel. 
These  capabilities  must  be  inserted  affordably  and 
within  the  cost  or  schedule  constraints  imposed  by 
the  military  budget. 

Many  technological  advances  having 
profound  implications  for  military  capabilities  are 
the  result  of  research  and  development  conducted 
by  commercial  firms  for  essentially  the 
commercial  markets.  Digital  products  found  in 
personal  computers  have  become  the  center  of 
focus  on  commercial  technology  insertion  as  they 
have  become  much  more  powerful  than  many  of 
the  computers  being  used  in  our  weapon  systems, 
and  at  dramatically  lower  prices  (see  Figure  2). 
The  power  of  the  processors  gives  intelligent 
weapon  systems  their  capabilities.  The  combined 
factors  of  expanded  capabilities  and  lower  costs 
are  clearly  compelling  reasons  to  integrate  these 


commercial  technologies  into  our  existing  and 
advanced  weapon  systems. 


Legacy  aircraft  issues  and  reasons  for  upgrade 

Recent  DoD  budgets  and  the  political 
climate  are  forcing  the  United  States  military 
aircraft  to  remain  operational  well  beyond  their 
projected  service  life.  These  life  cycle  extensions 
have  prompted  many  legacy  aircraft  upgrade 
programs.  In  addition,  today’s  military  aircraft 
must  perform  an  increasingly  broad  range  of 
missions  from  tactical/strike  to  reconnaissance 
and  electronic  warfare.  These  emerging  missions 
encompass  a  wide  range  of  avionics  functions, 
performance,  and  cost.  Several  platforms  are  in 
need  of  upgrades  due  to  the  need  for  increased 
connectivity,  the  lack  of  spares,  and  directed 
initiatives  that  require  increased  avionics 
performance/functionality.  However,  current 
budgets  have  been  reduced  to  the  point  where  it  is 
difficult  to  meet  all  requirements  using  the 
traditional  upgrade  methods  employed  during  the 
1980s  and  early  1990s. 

In  the  past,  piecemeal  system 
enhancements  were  performed  to  meet  new 
requirements.  These  piecemeal  retrofits  have 
resulted  in  point  designs  that  only  support  a 
particular  problem  and  platform.  As  a  result, 


other  platforms  could  not  readily  leverage  these 
developments.  Many  of  these  upgrades  were  not 
applicable  to  subsequent  upgrades  of  the  same 
subsystem,  and  as  time  passed,  upgrades  were 
layered  upon  each  other  compounding  the 
maintenance  problem.  Tight  coupling  of  the 
legacy  systems  forced  the  major  parts  of  the 
avionics  system  to  be  recertified,  which  became  a 
major  cost  driver  for  the  upgrade.  Furthermore, 
these  upgrades  must  be  performed  and  scheduled 
into  the  existing  maintenance  schedule  or  the 
existing  block  upgrade  cycle. 


upgrades  are  currently  funded.  Some  issues  are 
structural  in  the  present  procurement  and 
management  approaches.  Decisions  are  made  on 
a  program  by  program  basis,  and  we  see  no  trend 
to  decrease  the  authority  of  the  system  program 
directors.  Any  changes  to  aging  aircraft  avionics 
will  have  to  make  sense  to  the  weapons  system 
program  director,  while  providing  capabilities  and 
supportability  acceptable  to  the  user  command. 
Introduction  of  a  new  supportability  concept,  such 
as  one-  or  two-level  maintenance,  will  have  to 
prove  itself  in  the  context  of  the  existing 
supportability  plan  for  the  weapon  system, 
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Figure  2  Commercial  and  Military  Processing  Technology  Comparison 


Commercial  digital  technologies  have 
increased  in  performance  several  orders  of 
magnitude  over  the  past  decade.  Advanced  data 
and  signal  processing  capabilities  present 
opportunities  for  extending  the  life  expectancy 
and  meeting  new  mission  requirements  of  our 
existing  military  aircraft  by  inserting  new 
capabilities  in  weapon  system  platforms. 

Beyond  commercial  technology  insertion 
and  basic  logistics  problems,  there  are  issues  of 
administration,  funding,  and  organization  of  how 


possibly  with  a  3-  to  5-year  pay-back. 

Reasons  to  upgrade 

New  and  enhanced  mission  requirements. 

Legacy  avionics  designs  are  generally  based  on 
technology  that  is  at  least  15  years  old  and  at  least 
2-3  orders  of  magnitude  slower  than  commercial 
equipment  available  today.  Thus,  legacy  designs 
do  not  have  sufficient  capacity  to  meet 
requirements  demanded  by  the  new  and  enhanced 
missions,  even  if  significant  spare  and  growth 
room  is  built-in. 
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Increased  reliability  and  better  fault  isolation. 

Upgrades  using  modern  technology  allow  for 
increased  reliability  because  fewer  parts  and  fewer 
interfaces  are  required  to  provide  the  same 
functionality,  thus  providing  Life  Cycle  Cost 
(LCC)  savings  potential.  This  can  also  lead  to 
better  fault  isolation  because  fewer  can  not 
duplicate  (CND)  anomalies  are  produced. 

Component  obsolescence.  The  military  qualified 
components  used  on  legacy  systems  are  becoming 
obsolete  at  an  increasing  rate.  This  provides  an 
opportunity  to  upgrade  the  system  using  COTS 
parts  and  the  potential  for  substantial  LCC 
savings. 

Avionics  Software 

Modern  avionics  systems  are  expensive  to 
upgrade  because  the  software  is  designed  and 
built  to  tightly  integrate  and  operate  on  custom 
hardware.  This  situation  was  driven  by  the  need 
to  squeeze  every  last  cycle  out  of  hardware  to 
implement  that  next  feature.  Simply  stated, 
current  avionics  software  is  not  portable. 

However,  software  upgrade  and  maintenance 
costs  cannot  be  studied  or  solved  without  the 
defining  context  of  a  specific  system  architecture. 
Given  this  situation,  major  software  cost  drivers 
for  the  upgrade  of  legacy  systems  include  the 
following: 

1.  Recovery  and  understanding  the  original 

system  requirements  and  design 
constraints.  Lack  of  understanding  of 

these  requirements  causes  rebuilds  and 
sometimes  program  restarts  due  to 

erroneous  assumptions  and  poor  design 
choices  based  upon  incomplete  or 
inaccurate  information. 

2.  Interfacing  with  the  legacy  design 
philosophy  of  the  avionics  system  and 
sub-systems.  This  applies  for  both 
hardware  and  software  (language)  issues. 

3.  Interfacing  to  legacy  system  operating 

system  environment  to  meet  both 
scheduling  and  communication  interfaces. 
Often  times  this  is  not  a  clean  interface 
due  to  the  cyclic  nature  of  most  deployed 
systems  and  the  hardwiring  of  addressing 
on  the  communications  bus  (i.e.  1553). 
Traditional  approaches  to  solve  these 
problems  (e.g.,  sharing  memory,  bus 
snooping,  etc.)  are  error  prone  because  the 


new  system  cannot  determine  the  absolute 
state  of  the  legacy  system. 

4.  Re-certification  and  Re-validation  of  the 
system  and/or  sub-system  as  they  are 
incrementally  inserted.  The  cost  of 
validating  the  software  and  hardware  for 
safe  and  correct  operation  each  time 
functions  change  will  dominate  the  cost  of 
any  upgrade  involving  functional 
modification. 

5.  Fitting  major  software/hardware  builds 
and  insertion  into  the  normal  maintenance 
cycle.  The  time  to  develop  and  insert  a 
new  avionics  suite  (or  a  major  sub¬ 
system)  exceeds  the  standard  maintenance 
cycle. 

Upgrading  and  re-hosting  software  from  a 
legacy  avionics  computer  to  an  upgraded  one  is 
traditionally  a  very  expensive  effort.  The 
software  must  behave  substantially  the  same  on 
the  new  processor  as  on  the  old  one,  so  interface 
requirements  must  be  captured  and  tested.  Much 
legacy  code  is  closely  dependent  on  the 
architecture  and  operating  system  of  the  legacy 
computer  and  is  often  written  in  an  obsolete 
computer  language.  These  problems  conspire  to 
make  direct  re-hosting  of  the  code  nearly 
impossible.  Several  approaches,  including 
reengineering  of  the  code  or  encapsulating 
portions  of  legacy  code  with  modern  wrappers, 
show  promise  by  retaining  some  of  the  investment 
made  in  the  original  code  development.  Other 
approaches,  such  as  translation  and  emulation 
retain  even  more  of  that  investment  at  the  expense 
of  future  maintainability. 

Standards  apply  at  all  levels  of 
system/software.  To  aid  in  the  classification  of 
standards,  the  Society  of  Automotive  Engineers 
has  a  reference  model  called  the  “Generic  Open 
Architecture  model”  (GOA).  This  reference 
model,  shows  a  detailed  breakout  of  key  interfaces 
for  systems.  Each  of  the  GOA  interface  areas  are 
opportunities  for  reducing  the  level  of  interface 
incompatibility  within  future  systems,  improving 
upgrade  opportunities,  and  providing  the  basis  for 
procurement  guides.  For  example,  IEEE  POSIX 
defines  interface  standards  at  the  GOA  level  for 
operating  system  and  operating  system  services, 
and  has  many  commercially  available 
implementations.  POSIX  allows  any  application 
software  to  be  portable  to  another  system  that  uses 
a  POSIX  solution  for  the  level  of  interface. 
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Widely  commercially  used  standards  (e.g. 
CORBA  or  POSIX)  provide  access  to  a  wider 
base  of  professionals  that  have  used  the  standard, 
and  the  implementations  of  that  standard  have 
more  operational  hours — i.e.  fewer  defects.  This 
commercial  appeal  also  provides  better  and 
greater  numbers  of  available  development 
environments.  All  these  factors  lead  to  lower  cost 
for  systems  that  can  take  advantage  of  commercial 
software  interface  standards. 

Software  development  cost  has  been  the 
single  major  cost  driver  in  most  avionics 
improvement  programs.  An  effective 

incremental  upgrade  must  utilize  COTS 
technologies  to  shorten  the  software  development 
cycle  and  increase  productivity.  For  MIL-STD- 
1750  Processor-based  software  development,  few 
development  tools  are  available,  especially  for 
legacy  programming  languages.  Furthermore,  it 
is  not  uncommon  for  legacy  codes,  based  on  older 
languages  such  as  FORTRAN  and  JOVIAL,  to 
become  difficult  or  impractical  to  maintain  as 
familiarity  with  the  target  hardware  and  highly 
optimized  control  and  application  programs  and 
their  development  tools  diminishes  when  the 
engineers  who  designed  them  move  on.  For  these 
reasons,  software  engineers  have  begun  to  migrate 
away  from  proprietary,  application-specific 
architectures  towards  well-defined  COTS  open 
systems  standards  and  technologies  whenever 
possible.  (See  Figure  3)  This  involves  using 


system  environments  like  DOS,  UNIX,  VTRX® 
(MicroTech),  VxWorks®  (WindRiver);  and 
interfacing  to  software  Application  Program 
Interfaces  (API)  like  Windows®  (Microsoft)  or 
TCP/IP  communication  protocols. 

Group  A  modification 

Group  A  modifications  involve  permanent 
modifications  to  flight  equipment  on  the  aircraft. 
Avionics  upgrades  usually  require  major  Group  A 
modifications  at  significant  cost.  Studies 
conducted  by  the  Modular  Avionics  System 
Architecture  (MAS A)  Program  on  the  F-16  fleet 
indicate  that  at  least  three  “black  box”  systems 
must  be  integrated  into  one  before  modular 
upgrades  can  be  affordably  integrated  into  a  single 
black  box  replacement.  During  this  study  effort, 
conducted  in  1990  for  the  F-16,  it  was  concluded 
that  the  cost  of  additional  Group  A  wiring  changes 
could  be  justified  with  out-year  life  cycle  cost 
savings.  But  as  effective  service  life  decreases, 
the  life  cycle  cost  savings  are  amortized  across 
fewer  years.  In  general,  the  cross-over  point  for 
high  rates  of  aircraft  modernization  is 
approximately  10  years  of  remaining  service  life. 
For  low  rate  or  low  number  modernization  efforts, 
Group  A  development  cost  is  assumed  to  be  the 
dominate  cost  inhibitor.  In  various  studies 
conducted,  over  twelve  change  proposals 
incorporating  Group  B  equipment  were  altered  or 
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Figure  3  Open  Software  Architecture 


structured,  well  defined  languages  like  C  and 
C++;  employing  object-oriented  programming 
methods;  working  within  familiar;  broadly 
supported,  hardware  independent  operating 


reduced  in  scope  to  accommodate  limitations  of 
the  Group  A  changes.  One  significant  program 
was  canceled  due  to  estimations  for  F-16  Group  A 
cost  impacts.  The  results  of  this  analysis 
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provided  an  important  assumption  for  aircraft 
modernization.  If  future  upgrades  are  small  and 
incrementally  funded,  the  typical  upgrade  may  be 
projected  as  a  black  box  one-for-one  replacement, 
referred  to  herein  as  in-place  upgrade.  As  Group 
B  black  boxes  or  LRUs  are  upgraded,  the  physical 
wiring,  cooling,  power,  and  mechanical  interfaces 
will  largely  be  left  unchanged  for  the  remaining 
service  life. 

As  part  of  avionics  upgrades, 
modifications  to  existing  aircraft  electrical  and 
mechanical  configuration  items  may  be  required 
in  order  to  interface  with  the  new  elements. 
These  include  power,  cooling,  wiring  harnesses, 
mounting  fixtures,  cables,  connectors,  etc.  The 
modifications  can  be  extensive  and  time 
consuming  when  redesigning  of  existing  Line 
Replaceable  Units  (LRU),  replacing  and  adding 
new  wiring  harnesses,  and  on  aircraft  system 
integration  and  testing  are  involved. 

A  systematic  approach  that  allows 
insertion  of  improvements  utilizing  wiring, 
installation,  and  other  existing  aircraft  resources 
will  drastically  reduce  Group  A  modification 
costs.  The  practice  of  using  field  installable 
modification  kits  will  further  reduce  time-to-field 
and  unscheduled  aircraft  down-time. 

In  addition  to  electrical  and  mechanical 
changes,  a  major  consideration  to  upgrading 
legacy  avionics  is  their  network  architectures. 
MIL-STD-1553B  Multiplexed  Bus  structure  has 
been  the  standard  for  avionics  multiplexed 
communication  implementations.  While  the 
demand  for  faster  computational  capability  and 
data  communication  of  high  volume,  intermixed 
data  types  continues  to  increase,  bridging  the 
MIL-STD-1553B  time  division  multiplex  bus- 
based  avionics  architecture  (  1  Mbits/sec.)  into 
one  that  utilizes  several  orders  of  magnitude 
higher  network  throughput,  such  as  Serial 
Express,  Asynchronous  Transfer  Mode  (ATM),  or 
Gigabit  Ethernet,  has  become  necessary  to 
avionics  modernization.  By  expanding  the  use  of 
existing  MIL-STD-1553B  cabling  in  conjunction 
with  a  scalable  protocol  implementation.  Group  A 
modification  cost  can  be  minimized 

Changes  to  the  cooling  infrastructure  are 
expensive  and  usually  require  changes  to  the 
aircraft  structure.  Thus  cooling  air  found  in  most 
legacy  aircraft  is  the  heat  removal  medium.  Edge 


conduction  modules  have  a  higher  thermal 
dissipation  capability  than  convection  cooled 
modules,  plus  they  have  better  vibration  and 
shock  performance  due  to  their  central  heat  sink. 
It  may  be  possible  to  use  liquid  edge  conduction 
cooling  with  heat  exchangers  to  the  cooling  air  in 
cases  where  size  restrictions  and  the  resultant 
thermal  density  of  the  modules  require  greater 
thermal  dissipation  capability  than  cooling  air 
provides.  In  such  cases,  the  liquid  cooling 
infrastructure  (circulation  and  heat  exchangers) 
may  have  to  be  self-contained  in  the  avionics 
upgrade.  However,  a  prototype  avionics  liquid 
cooling  system  for  currently  fielded  aircraft  and 
for  the  retrofit  of  state-of-the-art  avionics  has  been 
demonstrated.  The  electrically  driven  vapor-cycle 
heat  pump  was  integrated  into  the  F-16’s  current 
cooling  system  and  increased  the  cooling  capacity 
by  5KW  thus  enabling  the  aircraft  to  be 
incrementally  updated  well  into  the  next 
millennium  with  advanced,  reliable  avionics  at 
low  cost. 

Avionics  Maintenance 

Typical  Operations  and  Support  (O&S) 
costs  run  approximately  70%  of  the  total  Life 
Cycle  Cost  (LCC).  Cost  distribution  is  spread 
over  Support  Equipment,  Depot  Maintenance 
Equipment,  Personnel,  Initial  Training,  Initial 
Technical  Data  and  Initial  Spares.  To  reduce  O&S 
costs,  avionics  systems  must  be  highly  reliable 
and  easy  to  operate.  Timely  repair  or 
replacements  will  minimize  Mean  Time  To  Repair 
(MTTR)  and  increase  Mean  Flight  Hours  Between 
Unscheduled  Maintenance  (MFHBUM).  Legacy 
aircraft  avionics  upgrades  must  introduce 
innovations  such  that  system  and  subsystems  level 
diagnostics  can  be  performed  to  provide  accurate, 
thorough  problem  identification  and  isolation.  In 
addition,  periodic  preventative  maintenance  can 
be  automated  and  prognostic  data  made  available 
for  trend  analysis.  Hence,  non-repeatable 
anomalies  can  be  eliminated. 

“Can  Not  Duplicate”  (CND)  faults  and 
“Retest  OK”  (RTOK)  problems  account  for  a 
large  percentage  of  the  maintenance  events  on 
legacy  aircraft.  Better  diagnostics  will  help  reduce 
these  problems,  but  some  of  the  solution  must 
come  from  the  design  of  the  system.  Reduction  in 
the  number  and  complexity  of  interfaces  will 
increase  reliability  and  reduce  CNDs.  Though 
CNDs  should  occur  less  frequently  in  a  reliable 
COTS-based  system,  when  they  occur,  a  method 
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must  be  provided  to  save  the  system  state  in  order 
to  duplicate  the  situation  and  attempt  to  diagnose 
the  cause  of  the  CND  in  a  laboratory. 

Mainstream  commercial  processors  and 
systems  do  not  normally  have  much  diagnostic 
capability  other  than  at  system  start  time.  Some 
systems  are  capable  of  isolating  memory  errors  to 
a  specific  failed  memory  module  and  some 
operating  systems  can  probe  devices  to  determine 
if  they  are  operating  normally,  but  other  than  that, 
very  little  isolation  is  available.  More  expensive 
computers  designed  for  high  availability,  such  as 
servers  and  supercomputers,  have  some  built  in 
fault  detection  and  isolation  along  with  redundant 
hardware  to  help  tolerate  the  faults.  Finally,  error 
correcting/detecting  memory  controllers  can  be 
used  to  help  correct  for  and  diagnose  failed 
memory  components.  These  techniques  and  others 
need  to  be  investigated  to  determine  how 
commercial  technology-based  avionics  upgrades 
can  diagnose  and  recover  from  failures  and  aid 
maintainers  in  determining  where  the  failure 
occurred 

Distributed  avionics  upgrades  require 
system  management  software  to  work  with  the 
health  monitoring  software  on  each  processor  to 
maintain  a  consistent  and  correct  view  of  the 
health  status  of  the  system.  When  failures  occur, 
the  system  manager  must  activate  the  programs 
impacted  by  the  failures  on  other  processing 
resources.  In  addition,  enough  system  state  must 
be  available  to  these  newly-activated  programs  so 
that  they  can  begin  operation  rapidly  and  not 
cause  any  mission-critical  functions  to  fail  for 
longer  than  a  specified  time.  An  overall  system 
health  maintenance  and  reconfiguration  approach 
must  be  integral  to  the  upgrade  architecture  and  its 
associated  system  software. 

Critical  to  legacy  aircraft  process 
evolution  is  the  support  strategy  and  maintenance 
improvements  introduced  to  legacy  aircraft 
weapon  systems.  The  definition  of  this  support 
strategy  is  key  to  establishing  lower  operational 
costs  when  service  life  decreases  as  a  function  of 
time  remaining  in  service  life.  In  addition, 
interfacing  the  weapon  system  to  the  global 
network  is  a  major  goal  for  future  product  support 
systems  in  order  to  establish  a  complete  network 
resource  to  determine  combat  status  of  individual 
weapon  systems  for  local  theater  commanders 
during  weapon  system  deployment.  The 


technology  provides  users  with  automated  pilot 
debrief,  advanced  diagnostics  and  electronic 
technical  manual  data  presentation  capabilities. 
The  new  technology  is  being  used  for  current 
legacy  aircraft  as  well  as  future  programs. 

The  Integrated  Maintenance  Information 
Systems  (IMIS)  technology  is  a  multi-level 
secure,  integrated,  distributed  task  and  decision 
support  system  that  automates  numerous 
processes  to  improve  pilot  debrief  and 
maintenance  performance  functions.  IMIS 
reduces  management,  supervisory  and  technical 
overhead  by  providing: 

1)  Real-time  access  and  interface  with  customer 
Logistics  Data  Systems  as  well  as  other 
Department  of  Defense  external  systems, 

2)  Aircraft  advanced  diagnostics  capability,  and 

3)  Display  of  Interactive  Electronic  Technical 
Manuals  (lETMs). 

The  system  reduces  the  hours  needed  to  service, 
troubleshoot,  and  repair  all  aircraft  systems  and 
assists  in  the  achievement  of  the  maintenance 
mission  goals  of  high  sortie  rates,  to  minimize 
aircraft  down-time,  and  to  provide  maintenance 
with  minimum  support  resources.  Obtaining 
accurate  data  of  aircraft  availability  and  status  is 
critical  to  mission  planning  and  repair  operations. 
Achieving  timely  and  accurate  data  from  field 
operations  is  an  important  aspect  to  understanding 
when  and  if  weapon  systems  require 
modifications  to  be  effective  in  their  missions.  As 
commercial  technology  is  inserted  into  legacy 
aircraft  systems,  it  becomes  crucial  to  monitor  the 
field  operations  of  these  equipments,  as  critical 
built-in-test  and  self-test  hardware  and  software  is 
generally  not  built  into  commercial  grade 
components  and  systems.  Hence  the  logistic 
system  must  be  modified  to  accommodate  and 
control  the  infusion  of  technology  into  the  fleet  of 
aircraft  and  provide  a  means  for  technology 
refresh,  as  shown  in  Figure  4. 

Aircraft  data  is  received  through  a  data  transfer 
cartridge  (DTC)  or  via  an  aircraft  maintainer 
vehicle  interface  (MVI).  Although  capable  of 
operating  as  a  stand-alone  system,  the  IMIS 
interface  can  communicate  logistics  data  through 
a  network  connection  to  external  systems.  IMIS 
consists  of  a  networked  computer  system  that 
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Figure  4  Logistic  Support  is  a  Vital  Aspect  of  Technology  Refresh 


communicates  with  Maintenance  Information 
Workstations  (MIW)  or  Portable  Maintenance 
Aids  (PM A).  The  system  components  can  be 
transported,  allowing  use  during  deployment. 
Current  IMIS  development  efforts  add  IMIS 
capability  to  provide  the  system  user  with  real¬ 
time  access  and  interface  with  customer  Logistics 
Data  Systems  as  well  as  other  DoD  external 
systems. 

Anticipated  benefits  of  the  IMIS  system 

include: 

•  50%  reduction  in  pilot  debrief  time 

•  30%  improvement  in  troubleshooting 
accuracy 

•  30%  reduction  in  Re-Test  OK  (RTOK) 
rates 

•  40%  reduction  in  the  time  to  repair  a 
malfunction  or  perform  maintenance 
actions  resulting  in: 

•  Improved  weapon  system  availability  and 
readiness 

•  Reduced  aircraft  down-time 

•  Improved  aircraft  sortie  rates 


•  Reduced  weapon  system  life  cycle  cost 

•  Improved  maintenance  data  collection 

Currently,  IMIS  is  in  F-16  field  service 
evaluation  and  supporting  the  F-22  Raptor 
aircraft.  Further  evaluation  is  required  to 
potentially  add  a  commercial  interface  standard 
such  as  Ethernet  to  allow  direct  access  to  aircraft 
weapon  systems,  either  wired,  spread  spectrum 
RF,  or  high  speed  IR  links  are  being  defined  as  an 
open  systems  approach  to  field  service  and 
support.  Another  element  of  the  IMIS  system  is 
the  integration  of  Interactive  Electronic  Technical 
Manuals.  The  Interactive  Electronic  Technical 
Manual  system  allows  the  user  to  locate  required 
information  faster  and  more  easily  than  the 
current  paper  technical  manuals.  IETMs  are  easier 
to  understand,  more  specifically  matched  to  the 
system  configuration  under  diagnosis,  and  are 
available  in  a  form  that  requires  much  less 
physical  storage  space  than  paper.  Interactive 
troubleshooting  procedures  have  been  added  using 
the  intelligent  features  of  the  IETM  display 
device. 

Application  of  COTS  products  to  upgrades 

The  use  of  commercial  technology-based 
components  is  becoming  more  and  more  essential 
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for  avionics  upgrades  because  of  the  lack  of 
availability  of  military-qualified  parts.  In  addition, 
commercial  components  are  normally 
significantly  less  expensive  and  have  higher 
capability  than  similar  military  parts.  While 
commercial  components  are  not  designed  for 
direct  application  to  military  avionics 
applications,  it  is  expected  that  methods  can  be 
employed  that  will  allow  them  to  operate  reliably 
and  cost  effectively  within  avionics  environments. 
The  use  of  COTS  components  presents  other 
issues  that  need  to  be  resolved  in  order  to  provide 
a  smooth  transition  to  COTS-based  avionics,  and 
recoup  the  cost  savings  that  would  make  the 
transition  worthwhile. 

Due  to  the  differences  in  the 
environments  of  the  various  legacy  platforms,  and 
the  resultant  variations  in  requirements,  a 
procurement  strategy  must  be  developed  that  can 
maximize  the  benefits  of  applying  COTS  to  the 
various  platforms.  In  addition,  aircraft  will  be 
upgraded  in  blocks,  but  the  COTS  technology 
used  will  most  likely  be  obsolete  before  the  block 
upgrade  is  complete,  so  there  needs  to  be  a 
configuration  management  scheme  and 
continuous  upgrade  process  in  place  that  allows 
inexpensive  insertion  of  newer  components  with 
low-cost  revalidation.  Methods  for  certifying  the 
aircraft  fleet  with  the  various  versions  of  the  block 
upgrades  must  be  defined.  Integration  of  the 
COTS-based  avionics  with  the  legacy  avionics 
need  to  be  addressed;  examples  of  integration 
issues  include,  but  are  not  limited  to,  interfaces, 
EMI,  and  architecture  changes.  Other  areas,  such 
as  support  equipment  and  training,  will  also 
require  attention  in  order  to  minimize  the  cost 
impacts  of  the  ever-changing  COTS  technology; 
this  would  include  such  areas  as  documentation 
changes  as  well. 

Due  to  the  fact  that  all  aircraft  in  a  fleet 
are  not  upgraded  at  once,  some  of  them  will  have 
different  hardware  configurations  than  others. 
Various  methods  exist  for  configuring  the 
avionics  hardware,  both  at  installation  and  at 
maintenance  time.  One  possible  technique 
involves  having  the  avionics  system  perform  a 
plug-and-play  type  operation  of  determining  the 
hardware  components  it  has  and  loading  the 
appropriate  software  from  a  mass  storage  device. 

Another  aspect  of  configuration  control  is 
the  logistics  aspects  of  the  hardware  components. 


It  is  possible  to  configure  the  aircraft  in  terms  of 
functionality  as  opposed  to  part  numbers. 
Hardware  components  are  made  to  be  Form,  Fit, 
Function  and  Interface  (F3I)  identical.  The 

3 

components  are  then  tracked  according  to  their  F  I 
classification  and  not  their  part  number.  Aircraft 
can  then  be  made  to  be  identical  as  far  as 
configuration  control,  and  the  logistics  can  be 
improved  due  to  a  reduction  in  "part  numbers" 
(F3I  numbers).  Of  course,  each  component  will 
have  to  meet  some  minimum  requirements  and 
testing  to  achieve  its  F  I  classification. 

Mil-Std-490  has  been  canceled  and 
replaced  with  a  handbook.  Government  /  Industry 
Data  Exchange  Process  (GIDEP)  interaction  with 
just  commercial  components  needs  to  be  fleshed 
out  along  with  RADC  traceability  and  controls. 
Mil  Std  965,  Parts  control  program,  being 
canceled  has  be  to  dealt  with  philosophically.  Is 
this  just  a  subcontractor  issue?  Are  we  partners? 

The  current  trend  of  higher  clock  speeds 
and  shorter  rise  and  fall  times  for  digital  circuits, 
plus  the  small  size  and  increased  sensitivity  of 
analog  circuitry,  presents  an  opportunity  for 
Electro-Magnetic  Interference  (EMI)  when  COTS 
components  are  used  in  avionics  applications. 

The  increased  functionality  that  can  be  fit 
onto  a  module  presents  the  potential  for  a  high 
density  of  circuitry  in  close  proximity. 
Precautions  must  be  taken  to  prevent  analog  and 
digital  circuitry  from  interfering  with  each  other. 
Moreover,  the  newer,  higher-speed  circuitry  may 
present  EMI  levels  that  exceed  the  levels  that 
legacy  avionics  were  designed  for.  Thus, 
precautions  must  be  taken  to  prevent  the  avionics 
upgrade  and  the  legacy  avionics  from  interfering 
with  each  other. 

Because  of  the  rapid  advances  in 
commercial  computer  technology,  COTS-based 
processors  should  be  the  most  cost-effective  part 
of  an  avionics  upgrade.  It  is  reasonable,  therefore, 
to  examine  which  traditionally  analog  avionics 
functions  can  be  handled  inexpensively  by  these 
processors.  Digital  radios  are  becoming  available 
in  the  commercial  arena,  so  it  makes  sense  to  push 
digital  technology  as  far  as  reasonable  in  avionics 
upgrades.  Digitizing  at  the  aperture  could 
eliminate  costly  waveguides  and  high- 
maintenance  analog  hardware,  replacing  it  with 
digital  networks  and  signal  processing.  This 
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approach  to  upgrades  may  reduce  cost,  weight, 
and  volume,  while  enhancing  maintainability. 

Quality  Assurance  -  Quality  assurance 
(QA)  objectives  of  military  systems  must  be 
maintained  when  applying  commercial  product 
QA  standards  established  by  the  International 
Standard  Organization  (ISO).  It  has  been 
demonstrated  that  streamlined  COTS  processes 
and  procedures  can  reduce  Life  Cycle  Costs  and 
also  meet  the  needs  of  military  applications  when 
applied  appropriately. 

Operational  Requirements  -  Applicable 
thermal,  random  vibration,  pressure/altitude, 
electromagnetic  and  other  military  operational 
requirements  must  continue  to  be  satisfied  when 
COTS  elements  are  introduced  in  weapon 
systems.  A  number  of  COTS  products  are 
presently  qualified  for  many  legacy  aircraft’s 
avionics  operating  environments.  The  associated 
COTS  suppliers  have  implemented  engineering 
options  for  meeting  different  operational 
requirements. 

A  technology  “bridge”  must  be 
continuously  maintained  into  the  design  of 
incremental  upgrades,  so  that  parts  obsolescence 
and  low  cost  COTS  insertion  can  become  facts  of 
life  to  legacy  avionics  systems. 

Obsolescence  and  Rapid  Design  Changes 

The  life  cycle  of  microcircuit  technology 
is  getting  shorter  and  shorter.  In  the  60’ s  the 
market  availability  life  expectancy  was  20-25 
years.  The  market  availability  life  expectancy  of 
microcircuits  from  the  70’ s  was  reduced  to  15-20 
years.  This  was  further  reduced  in  the  80’ s  to  10- 
15  years.  Today  the  market  availability  life 
expectancy  of  new  microcircuits  is  7-10  years  and 
this  includes  introduction  and  phase-out.  In 
reality,  for  some  of  the  high-performance 
microcircuits  like  processors  and  memories,  the 
market  availability  life  expectancy  is  less  than  5 
years.  This  presents  a  problem  for  military 
systems,  which  are  generally  designed  to  operate 
for  a  life  span  of  20  to  30  years. 

It  is  not  uncommon  for  military  avionics 
to  be  obsolete  before  it  is  deployed.  Many  modern 
systems,  including  the  F-22  and  C-17,  have 
undergone  major  avionics  upgrades  before 
achieving  operational  status.  Between  the  changes 


in  requirements  due  to  the  global  and  national 
political  climates  and  the  rapid  evolution  of 
technologies  applicable  to  avionics,  the  custom 
architectures  created  to  solve  the  original 
problems  become  rapidly  outdated  and  very 
expensive  to  change. 

Some  of  the  major  cost  factors  for  obsolescence 
and  design  changes  are  described  below: 

•  The  current  rate  of  technology  turnover  in  the 
digital  circuit  market  is  staggering.  The  mean 
time  to  obsolescence  for  all  digital  parts  is 
around  24  months,  and  processors  are 
becoming  obsolete  in  less  than  18  months.  For 
military  avionics,  this  situation  is 
compounded  by  the  fact  that  there  are  a 
decreasing  number  of  silicon  foundries 
producing  military  grade  parts,  and  those 
foundries  are  producing  fewer  military  parts. 
It  is  simply  not  cost  effective  for  these 
companies  to  tie  up  valuable  production 
capability  for  a  minority  market  segment. 
Military  parts  do  not  drive  the  market  for 
digital  circuits,  and  the  military  supplier  must 
learn  to  use  commercial  digital  parts  to  deliver 
future  avionics  systems  and  avionics  system 
upgrades. 

Digital  components  are  not  the  only  system 
components  that  are  affected  by  technology 
change.  Software  interface  standards,  bus 
standards,  protocol  standards,  network 
standards,  and  others  all  change  at  different 
rates.  Each  of  these  system  components  are 
cost  risk  factors  for  new  or  upgrade  avionics 
systems. 

•  The  non-recurring  engineering  (NRE) 

required  to  capture  the  existing  system 
interfacing  requirements  is  non-trivial.  The 
system  documentation  does  not  contain  the 
wisdom  of  the  original 

designers/implementors,  and  many  times 
these  people  are  no  longer  available.  Further, 
the  documents  do  not  reflect  the  current  state 
of  the  system  —  or  are  missing  the  fine  details 
to  make  the  system  really  work.  Accurate 
specifications  of  the  system  interfacing  and 
function  are  required  to  upgrade  avionics 
systems. 

•  Beyond  the  problems  of  understanding  the 
system  interfaces  and  function,  the  upgrade 
avionics  system  must  pass  several  re¬ 
certification  levels.  Flight  qualification, 
system  acceptance,  and  a  number  of  other 
tests  are  required  before  the  upgraded  system 
can  be  deployed.  The  cost  of  re-certification 
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of  avionics  systems  can  be  a  major  cost 
driver  . 

•  One  of  the  major  operations  and  support  cost 
is  the  logistics  to  track  and  store  spare  parts 
for  aircraft  systems.  If  lifetime  buys  are 
considered,  several  cost  factors  must  be 
contemplated.  First,  the  sunk  cost  of  the 
lifetime  buy.  Second,  the  additional  logistics 
cost  for  tracking  and  storing  more  parts. 
Third,  the  cost  risk  of  those  parts  becoming 
obsolete  before  the  parts  are  used.  Finally,  the 
cost  of  monitoring  the  obsolescence  status  of 
parts  within  a  design.  All  these  cost  factors 
must  be  considered  for  the  lifetime  buy 
option. 

Parts  obsolescence  is  also  an  issue  for 
military  components  but  not  nearly  as  severe  as  it 
is  in  the  highly-competitive  COTS  environment 
(see  Figure  5).  Provisions  for  the  management  of 
obsolescence  need  to  be  in  place  from  the 
beginning  of  the  design  process.  Obsolescence 
considerations  must  be  part  of  any  trade-off 
studies  performed  in  order  to  select  candidate 
COTS  technologies  for  use  in  a  military  system 
with  an  extended  operational  life.  One  way  to 
manage  obsolescence  involves  drastic  changes  in 
the  way  the  military  acquires  systems.  It  entails 
having  a  number  of  short  development  and 
procurement  cycles  throughout  the  life  of  the 


system,  where  upgrades  are  incorporated  into  the 
system.  These  short  development  cycles  would 
include  the  required  testing  to  recertify  the 
integrity  of  the  system.  If  done  right,  this 
approach  can  eliminate  the  need  for  many  of  the 
logistic  support  requirements.  If  the  equipment  is 
highly  reliable  and  low  cost,  only  a  small  number 
of  spare  parts  will  be  required  to  sustain  the 
system  in  operation.  Upgrades  could  be  available 
before  any  failures  occur,  eliminating  the 
requirements  for  a  complex  logistics  support 
structure. 

A  planned  obsolescence  approach  is 
required  for  systems  using  technologies  with  a 
high  rate  of  change.  One  approach  to  address  this 
technology  change  is  to  develop  an  overall  system 
architecture  that  uses  well  defined  (and  widely 
used  interfaces)  for  those  items  that  are  subject  to 
rapid  obsolescence.  Widely  used  interfaces  will 
tend  to  have  support  strategies  to  get  to  the  next 
standard  (e.g.,  interface  chips  that  bridge  the  old 
interface  to  the  new  one).  Less  popular  (or  even 
custom)  solutions  can  be  used  for  system 
architecture  components  that  do  not  change 
rapidly  (i.e.,  antennas  or  radio  frequency 
amplifiers). 

From  this  baseline  upgrade  open 
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architecture,  portions  of  the  architecture  can  be 
inserted  incrementally  until  the  system  achieves  a 
fully  upgraded  state.  Then  as  components  of  that 
architecture  become  obsolete,  they  can  be  easily 
replaced  with  newer  generation  parts.  Part  of  this 
approach  is  the  establishment  of  an  obsolescence- 
management  contractor-based  sub-IPT  early  in  the 
program.  The  IPT  would  be  in  charge  of: 

•  Performing  detailed  obsolescence  surveys 
of  potential  suppliers 

•  Maintaining  current  survey  results  on  file 

•  Identifying  single  point-of-contact  for 

obsolescence  notification  in  each  of  the 
sub-contractors  involved  in  the  program 

•  Monitoring  and  maintaining  life-cycle 

ratings  for  all  the  active  technologies 

being  used  in  the  program 

•  Rating  of  technologies  longevity  by 

families 

•  Performing  program  baseline  reviews 

•  Establishing  and  maintaining  a  master 
parts  file  repository 

•  Recording  and  maintaining  a  lessons- 
learned  file. 

A  design  capture  process  using  “model- 
in-the-loop”  techniques  also  helps  solve  problems 
with  obsolescence  of  commercial  technology- 
based  upgrades.  The  design  capture  process 
results  in  a  detailed  executable  specification  that 
can  be  verified  using  system  acceptance  tests  and 
other  real-world  inputs.  This  executable 
specification  can  then  be  implemented  in  various 
ways,  including  a  VHDL-derived  replacement 
part,  software  emulation,  or  a  modern-technology 
software  simulation.  When  the  first 
implementation  becomes  obsolete,  due  to 
unavailable  parts  or  for  other  reasons,  a  new 
instantiation  of  the  system  can  be  derived  from  the 
executable  specification  at  a  substantially  reduced 
cost.  This  new  replacement  may  or  may  not  use 
the  same  implementation  choice  as  the  first 
upgrade,  but  since  the  executable  specification 
already  exists,  little  or  no  time  needs  to  be  spent 
deriving  requirements  or  defining  test  procedures. 

By  using  executable  specifications  (e.g., 
VHDL)  to  describe  digital  components, 
replacement  parts  that  meet  the  functional 


specifications  can  be  achieved.  Commercial 
industry  routinely  uses  VHDL  to  fabricate  or 
program  gate  arrays  and  other  programmable 
logic  families  (e.g.,  FPGAs,  PALs,  GALs,  etc.) 
via  commercially  available  synthesis  tools.  While 
not  perfect,  this  process  can  be  used  to  describe 
large  levels  of  functionality  (e.g.,  processor  and 
I/O  boards).  Other  interfaces  (e.g.,  physical, 
electrical,  ...)  can  be  achieved  through  the  use  of 
custom  packages  or  adapters.  This  is  approach  is 
possible  because  of  the  rapid  size  and  form-factor 
reductions  being  seen  in  the  programmable  logic 
arena. 

Open  System  Implementation 

The  primary  system  implications 
associated  with  the  use  of  COTS/Best 
Commercial  Practices  occur  at  the  avionics 
architecture  level.  A  major  concern  is  that,  taken 
to  the  extreme,  reduced  contractor  guidance  could 
result  in  a  “hodgepodge”  of  custom  boxes, 
modules,  display,  etc.  which  will  create  an 
integration  and  maintenance  nightmare,  destroy 
competitive  procurements  (competitors  cannot 
determine  how  to  build  compatible  hardware  and 
software)  and  make  common,  interoperable 
avionics  impossible.  Obviously,  measures  must 
be  taken  to  avoid  this  situation. 

One  measure  that  has  the  potential  of 
reducing  some  of  these  problems  is  the  use  of  an 
Open  System  Architecture  (OSA)  for  future  and 
current  systems.  Definitive  guidelines  of  how 
OSAs  will  be  employed  are  currently  under 
review  by  a  DoD  task  force.  The  OSA  approach 
is  aimed  at  ensuring  maximum  competition  and 
common  avionics,  through  a  readily  available  set 
of  system  specifications  that  provide  adequate 
information  to  build  interface-compatible 
hardware  and  software. 

The  key  is  to  define  an  OSA  that  will 
permit  an  incremental  upgrade  strategy  utilizing 
modular,  scaleable  components  which  can  be 
inserted  into  the  diverse  set  of  fielded  legacy 
architectures.  This  architecture  will  provide  a 
framework  that  can  be  installed  in  affordable 
increments  into  legacy  aircraft  while  retaining 
coherent  system  functionality.  The  ability  to 
incrementally  upgrade  a  system  is  important,  not 
only  due  to  budget  realities,  but  also  because  it  is 
typically  impractical  to  complete  a  major  system 
insertion/replacement  within  a  single  normal 
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maintenance  cycle.  Aircraft  downtime  for  kit 
insertion,  functional  validation  and  training  must 
be  taken  into  consideration  for  reducing  time-to- 
field  in  both  engineering  and  manufacturing 
development  and  production  phases  of  an 
upgrade. 

The  incremental  OSA  approach  gradually 
migrates  the  legacy  system  to  a  new  coherent, 
easier~to-upgrade  architecture  that  avoids  the 
current  patching  problem.  These  incremental 
upgrades  can  be  accomplished  in  less  time  and  at 
lower  cost  than  would  otherwise  be  imposed  by 
traditional  upgrade  methods.  Closely  related  to  the 
installation  problems  (Group  A)  described  earlier 
are  functional  interface  issues.  If  incremental  and 
continuous  upgrades  are  to  be  successful,  well 
defined  functional  interfaces  must  be  established 
between  the  portion  that  is  being  upgraded  and  the 
portion  that  is  not  (see  Figure  6).  The  purpose  of 
these  interfaces  is  to  establish  boundaries  so  that 
the  upgraded  portion  may  not  affect  the 


difficult  to  apply  to  existing  systems  on  an 
incremental  basis.  Open  systems,  properly 
executed,  promote  competition  and  provide  value 
to  the  customer  at  lower  cost.  Distributed  open 
systems  are  an  alternative  that  bears  study,  along 
with  domain-specific  architectures  for  displays 
and  display  processing,  data  and  satellite 
communication  links,  and  mission  processing 
upgrades.  Specific  aspects  of  an  upgrade 
architecture,  such  as  software  re-hosting,  would 
be  applied  system  wide.  The  issue  is  the  cost  of 
changes  to  the  existing  system,  including  test  and 
maintenance  equipment,  procedures,  and 
documentation,  versus  the  benefit  of  a  new 
integrated  architecture. 

Open  interfaces  that  satisfy  widely-used 
standards  are  essential  to  implement  incremental 
upgrades.  One  upgrade  can  then  benefit  from  the 
investment  and  knowledge  base  of  the  previous 
one,  such  that  we  do  not  waste  money  solving  the 
same  system  problem  over  and  over  again. 
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Figure  6  Upgraded  Avionics  Integrated  Through  Well  Defined  Open  Interfaces 


functionality  of  the  portion  that  is  not  being 
modified.  If  this  is  not  done,  a  “ripple”  effect  is 
likely  to  occur  where  changes  affect  parts  of  the 
system  that  don’t  need  to  be  changed.  Not  only 
does  this  unnecessarily  increase  the  life-cycle 
cost,  it  also  leads  to  the  unwanted  piecemeal 
designs  described  above.  While  new  weapon 
system  developments  are  emphasizing  open 
integrated  architectures,  these  concepts  may  be 


Previous  attempts  at  common  module  and  open 
interface  programs  have  failed  to  provide  for  the 
future  insertion  of  rapidly  evolving  digital 
technology,  or  have  selected  interfaces  whose 
usage  is  limited  almost  entirely  to  military 
systems. 

Avionics  upgrades  generally  involve 
changes  to  both  hardware  and  software,  usually  to 
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accommodate  new  functional  or  performance 
requirements,  but  occasionally  to  reduce  cost  of 
ownership.  We  expect  that  affordable  upgrades 
will  become  even  more  of  a  challenge  as  the 
number  of  software  lines  of  code  in  our  fielded 
systems  increases  dramatically  during  the  next 
decade. 

Piecemeal,  single-platform  upgrades  are 
here  to  stay  as  long  as  the  acquisition  process  is 
governed  by  individual  program  offices  and 
funding  horizons  are  short  term.  Incremental 
upgrades  are  desirable  over  piecemeal  upgrades 
given  the  reality  of  the  current  budgeting  process. 
Present  approaches  do  not  institutionalize  the 
relevant  methodologies  and  architectural 
concepts,  but  rather  force  them  to  be  relearned 
each  time  by  individual  contractor  teams.  The 
result  is  a  much  longer  and  more  expensive 
upgrade  activity,  every  time. 

Summary 

Industry  has  embarked  on  a  product-line 
implementation  strategy.  The  major  Weapon 
System/ Aircraft  Manufacturers  are  in  the  process 


of  defining  an  open  system  avionics  architecture 
based  on  commercial  technologies  and  processes 
which  will  be  applied  across  the  product  lines 
which  they  manufacture.  Much  of  this  activity  is 
focused  on  aging  aircraft  avionics  issues  to  extend 
the  service  life  of  current  aircraft  coupled  with 
declining  military  budgets  and  a  dwindling 
supplier  base  which  challenges  the  effectiveness 
of  today’s  front  line  weapon  systems.  This 
approach  has  been  developed  by  working  with 
numerous  government  agencies  and  across  the 
services  as  well  as  internal  company  funding  to 
produce  a  focused  strategy  for  maintaining  the 
effectiveness  of  legacy  systems  while  charting  a 
future  business  strategy  similar  to  large 
commercially  oriented  corporations. 

Effective  use  of  advanced  technologies 
derived  through  Science  and  Technology 
programs  can  only  be  accomplished  through  a 
continuous  Demonstration  and  Evaluation 
Program.  This  program  must  be  a 
government/industry  partnership  aimed  at  the 
transition  of  needed  advanced  technologies  from 
the  research  environment  to  the  warfighter.  (See 
Figure  7) 
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INTRODUCTION 

The  question  of  the  structural  integrity  of  aging  aircraft 
became  an  issue  of  grave  concern  when  an  Aloha 
Airlines  Boeing  737  suffered  major  structural  damage  in 
April  1988  while  in  flight.  Since  then  the  airworthiness 
issue  of  aging  aircraft  has  been  the  concern  of 
manufacturers,  and  civilian  and  military  operators  alike. 
The  issues  for  civilian  and  military  operators  are 
structural  integrity  and  reduced  ownership  cost  when  the 
service  life  is  extended.  The  military  have  the  additional 
task  of  maintaining  preparedness  with  improved 
availability  and  enhancing  the  performance  of  aircraft 
designed  for  now-obsolescent  missions  to  meet  new 
mission  requirements.  Aging,  therefore,  does  not  mean 
“old”  in  terms  of  the  number  of  calendar  days,  but  the 
cumulative  effect  of  technical  obsolescence,  changing 
requirements,  quality  of  maintenance  and  the  nature  of 
operation  (i.e.,  load  and  environment). 

The  issues  of  structural  integrity  for  rotary-wing  aircraft 
are  somewhat  different  from  those  of  fixed-wing  aircraft. 
In  helicopters,  the  dynamic  rotor  components  are  safe- 
life  designs  and  are  replaced  at  the  end  of  their  service 
lives.  Thus,  airworthiness  concerns  of  structural 
integrity  for  helicopters  are  limited  but  still  pose  great 
challenges  in  adjusting  to  changing  missions.  Structural 
integrity  issues  for  helicopters  are  in  the  airframe, 
equipment  and  avionics,  and  retention  hardware  for  non¬ 
airframe  related  structures.  Most  of  the  rotary-wing 
aircraft  in  the  U.S.  Army's  inventory  are  several  decades 
old,  and  are  required  to  continue  in  service  even  longer. 
Table  1  (Ref.  1).  They  were  designed  for  missions  that 
have  changed  and  with  equipment  that  have  been 
overtaken  by  technological  advances.  Thus,  the  primary 
issues  for  aging  military  helicopters  have  been  to  assure 
structural  integrity  while  enhancing  performance  with 
more  capable  dynamic  components  and  technically 
advanced  equipment. 


The  average  age  of  aircraft  in  the  U.S.  Navy's  inventory 
show  a  similar  trend  for  rotary-  and  fixed-wing  aircraft, 
Fig.  1  (Ref.  2).  The  average  age  of  helicopters  is  19.2 
years  and  continues  to  climb  until  2005,  when  aggressive 
procurement  of  new  helicopters  will  lower  their  average 
age.  To  continue  to  field  these  aircraft,  their  upgrades 
should  be  a  planned,  continuous  improvement  process  in 
order  to  dovetail  each  stage  of  upgrade  and  prevent  the 
cost  associated  with  a  one-time  upgrade.  Because  of  the 
severe  environment  in  which  the  U.S.  Navy  helicopters 
operate,  it  is  more  convenient  to  replace  life-limited  parts 
than  to  inspect  them  to  damage  tolerance  or  other  aging 
aircraft  requirements  in  order  to  assure  structural 
integrity  under  extended  service-life  procedures,  Ref.  3. 
Damage  tolerance  for  the  U.S.  Navy  is  a  “band  aid  - 
short-term  solution,”  only  to  “maintain  immediate  flight 
safety,  eliminate  the  problem  and  return  to  safe-life 
operation.” 

To  focus  on  the  structural  issues  of  aging  helicopters,  the 
causes  of  worldwide  accidents  of  civilian  helicopters  in 
1999  are  examined  in  Fig.  2,  Ref.  4.  The  majority  of  the 
accidents  were  due  to  pilot  error  followed  by  engine 
failure  or  power  loss.  Six  structural  failures  were  the 
causes  for  3.1  percent  of  the  accidents.  The  six  structural 
failures  were:  (1)  the  tailboom  separated  on  a  Bell  407, 
(2)  the  retaining  nut  and  bolt  for  the  tail  rotor  shaft  failed 
on  a  Bell  206L1,  (3)  “major  mechanical  failure”  on  a 
Hughes  369D,  (4)  a  main  rotor  tension-torsion  strap 
failed  on  a  BK  117B-1,  (5)  a  HH-43F  was  seen  to 
“explode  and  disintegrate  in  flight,”  and  (6)  bolts  in  the 
mounts  of  the  90°  gear  box  failed.  The  tension-torsion 
strap  is  a  safe-life  design  and  is  replaced  at  the  end  of  its 
service  life.  The  failures  of  the  tailboom,  the  tail  rotor 
shaft  retaining  system  and  the  mounts  of  the  90°  gear 
box  are  structural  issues  concerning  aging  helicopters. 
The  age  of  these  aircraft  and  the  precise  causes  of 
structural  failure  are  not  known. 


Table  1  Age  of  Rotary- Wing  Aircraft  in  the  U.  S.  Army  (Ref.  1) 


Type 

Number  of  Aircraft 

Average  Age,  Years 

Retirement  Date 

OH-58  A/C 

474 

35.0 

2017 

OH-58D 

387 

12.5 

2024 

CH-47D 

466 

20+ 

2033 

AH-1 

389 

30+ 

2017 

UH-1H/V 

1073 

29.0 

2025 

UH-60A 

906 

17.0 

(Not  Set) 

UH-60L 

515 

6.0 

(Not  Set) 

Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “ Aging  Engines,  Avionics,  Subsystems  and  Helicopters ”, 
held  in  Atlantic  City,  USA,  23-24  October  2000;  Madrid,  Spain,  26-27  October  2000,  and  published  in  RTO  EN-14 . 
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Fig.  2  Causes  of  worldwide  civilian  helicopter  accidents  in  1999  (Ref.  4) 


The  aging  issues  among  helicopter  operators,  ordered  in 
terms  of  the  total  cost,  are  engines,  dynamic  components 
and  drive  train,  equipment,  airframe,  and  avionics.  For 
medium  and  heavy  helicopters,  the  breakdown  of  the 
acquisition  cost  and  direct  maintenance  cost  (DMC)  as 
percentages  of  the  total  cost  are  shown  in  Fig.  3,  Ref.  5. 
The  total  cost  is  the  sum  of  acquisition  cost,  DMC  and 
operating  cost.  The  percentages  for  insurance,  fuel  and 


crew  -  elements  of  the  operating  cost  -  are  also  shown  in 
the  figure. 

Ignoring  the  cost  of  labor,  the  DMC  for  engines, 
dynamic  components  and  drive  train,  avionics  and 
equipment  are  much  higher  than  dial  for  the  airframe. 
The  DMC  for  airframe  is  lowest  at  10  percent  of  die 
acquisition  cost,  while  that  of  dynamic  components  is 
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138  percent.  The  DMC  of  dynamic  rotor  components  is 
high  because  of  replacement  cost  following  their  useful 
service  life.  The  engines  and  drive  train  are  specialized 
designs  and  their  aging  issues  will  not  be  discussed  here. 
Engine  and  drive  train  designers  are  contributing  to 
enhancing  reliability  through  simplified  designs  and 
higher  power-to-weight  ratio  systems.  Avionics  will  also 
not  be  discussed  as  avionics  designers  address  cost  and 
reliability  through  the  development  of  a  family  of 
avionics  systems,  and  address  continuous  upgrades  with 
open  operating  systems.  Equipment  includes  fuel  cells, 
wiring  harnesses  and  retention  hardware  of  all  systems. 
Wiring  systems  “age”  because  of  environmental 
conditions,  vibration,  operational  wear  and  tear,  and 
improper  repair. 

This  overview  presents  the  structural  integrity  issues  in 
extending  the  service  lives  of  dynamic  components  and 
airframes  of  aging  helicopters.  With  the  use  of 
composites,  the  acquisition  cost  and  DMC  of  dynamic 
components  have  reduced  greatly  over  the  last  two 
decades.  This  reduction  has  been  possible  because 
innovative  designs  of  complex  geometry  can  be 
fabricated  more  accurately  and  cost-effectively  with 
composite  manufacturing  technologies.  In  addition, 
significant  developments  have  occurred  to  make  rotor 
design  more  efficient,  Ref.  6.  However,  the 
methodologies  for  calculating  service  lives  and  their 
optimum  applicability  are  still  being  discussed.  These 
issues  on  structural  integrity  are  presented  and  discussed 
below.  Even  though  all-composite  dynamic  components 
have  been  in  service  for  several  decades,  an  all¬ 
composite  airframe  is  still  not  a  reality.  The  total 
composite  content  in  the  airframe  and  rotor  of  production 


helicopters  in  1992  was  around  25  percent.  Fig.  4.  Thus, 
some  of  the  aging  issues  of  fixed-wing  aircraft  are  still 
applicable  to  metal  airframes  of  the  helicopter  though  the 
problems  are  less  severe. 


STRUCTURAL  INTEGRITY  ISSUES  FOR 
HELICOPTERS 

In  the  design  of  rotorcraft  structures,  the  objective  of 
assuring  structural  integrity  is  to  reduce  to  zero  the 
probability  of  catastrophic  failure.  Rotorcraft  structures 
can  be  classified  as  two  distinct  types:  dynamic 
components  and  non-dynamic  components  of  the 
airframe.  Dynamic  components  are  those  of  the  rotor 
systems  and  are  subjected  to  high-cvcle  oscillatory  loads. 
As  shown  in  Fig.  2,  loss  of  structural  integrity  was  the 
cause  of  3.1  percent  of  the  1999  accidents  surveyed.  To 
get  a  better  understanding  of  the  typical  causes  of,  and 
the  frequency  of  occurrence  of  these  causes  in,  rotorcraft 
accidents,  an  Eurocopter  study  of  accidents  over  five 
years  on  a  worldwide,  all-missions  basis  identified  37 
accidents  per  one  million  flight  hours,  Ref.  7.  Of  the  37 
accidents,  16  resulted  in  fatalities.  The  precise  causes  of 
structural  failures  were  identified  and  were  found  to  be 
responsible  for  only  0.3  percent  of  the  accidents,  while 
incorrect  maintenance  was  responsible  for  17  percent  and 
engine  malfunction  for  3.1  percent.  Fig.  5.  The 
predominant  cause,  constituting  77  percent  of  all 
accidents,  was  operational  and  environmental  conditions. 
The  0.3  percent  from  structural  failures  were  due  to 
“poor  design,  non-conformity  of  components,  more 
severe  load  spectrum  than  expected”  and  non-identified 
causes  of  fatigue  cracks. 


Fig.  3  Breakdown  of  costs  for  medium  and  heavy  helicopters  (Ref.  5) 


5-4 


YEAR  OF  FIRST  FLIGHT 

Fig.  4  Application  of  composites  in  helicopter  to  1992  (Ref.  6.) 
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Fig.  5  Causes  of  37  rotorcraft  accidents  per  a  million  flight  hours  (Ref.  7) 


The  causes  of,  or  catalysts  for,  fatigue  cracks  leading  to 
failures  can  be  assigned  to  the  development, 
manufacturing  and  operational  processes  of  rotorcraft. 

In  development,  causes  include 

•  design  oversights, 

•  underestimating  loads,  and 

•  analyses  oversights. 

In  manufacturing,  causes  or  catalysts  include 


•  planning  oversights 

•  non-conformal  parts,  and 

•  manufacturing  defects. 

In  operation,  causes  or  catalysts  include 

•  usage  more  severe  than  expected, 

•  corrosion, 

•  improper  or  inadequate  service,  and 

•  service  defects. 


The  defects  introduced  during  manufacturing  or  in 
service  are  not  causes  but  act  as  catalysts  that  initiate 
fatigue  cracks,  which  may  then  lead  to  failures.  The 
survey  of  helicopter  accidents  in  Reference  7  identified 
catalysts  for  the  cracks,  and  the  frequency  with  which 
they  occur  is  shown  in  Fig.  6. 

Rotorcraft  manufacturers  validate  structural  integrity  and 
assure,  through  test  and  analysis,  that  the  level  of 
baseline  integrity  will  be  maintained  during  operation. 
The  manufacturers  also  provide  guidance  on  how  this 
integrity  can  be  continued  to  be  assured  in  service 
through  inspection,  and  what  provisions  are  available 
when  the  integrity  is  sufficiently  degraded  where  safety 
of  flight  will  be  jeopardized. 

Of  all  the  structures  fabricated  by  helicopter 
manufacturers,  dynamic  components  are  the  key  to  the 
helicopter's  performance  to  stated  requirements. 
Dynamic  components  also  have  the  highest  DMC 
compared  to  all  other  components.  Fig.  3.  Dynamic 
components  are  subjected  to  large  numbers  of  spectra  of 
oscillating  loads  and  generally  fail  in  fatigue.  Several 
approaches  are  taken  by  manufacturers  to  certify 
dynamic  components.  The  terminology  used  to  describe 
these  approaches  will  be  first  defined,  followed  by 
descriptions  of,  and  discussions  on,  the  substantiation 
methodologies.  The  aging-related  issues  and  the 
differences  between  certifying  metallic  and  composite 
components  are  included  in  the  discussions.  The  merits 
of  the  various  definitions  of  the  terminology  are  not 
discussed  and  the  primacy  of  any  one  methodology  is  not 
championed. 

There  are  four  “traditional”  approaches  for  substantiating 
the  life  of  components  in  order  to  assure  safety  of  flight: 
safe-life,  damage  tolerance,  fail-safe  and  flaw  tolerance. 
These  four  approaches  form  the  basis  of  the  decision 
process  on  whether  a  part  be  retired  and  replaced  based 
on  accumulated  flight  hours,  or  retired  based  on  the 
damage  sustained,  or  returned  to  service  after  repairing 


the  damage.  From  practical  considerations,  components 
may  be  substantiated  by  any  one  of  the  approaches  or  by 
a  combination  of  several  approaches.  The  definitions  of 
the  four  traditional  approaches  are  given  below. 

Definitions 

Safe-Life 

Safe-Life  is  defined  by  the  US  Federal  Aviation 
Administration  in  Reference  8  as, 

“Safe-Life  of  a  structure  is  that  number  of 
events  such  as  flights,  landings  or  flight  hours, 
during  which  there  is  a  low  probability  that  the 
strength  will  degrade  below  its  design  ultimate 
value  due  to  fatigue  cracking  ” 

The  safe-life  approach  assigns  a  finite  life  to  a 
component.  This  definition  focuses  on  the  baseline 
strength  and  its  degradation  in  operation.  The  definition 
also  infers,  and  its  application  alleviates,  the  difficulties 
and  cost  of  inspecting  complex  rotorcraft  structures.  The 
static  and  fatigue  strengths  and  their  progressive  losses 
can  be  determined  through  test,  or  in  combination  with 
analysis.  The  safe-life  approach  is  based  on  the  remote 
possibility  of  a  crack  initiating  in  a  component,  and  it 
recommends  that  the  component  be  retired  when 
accumulated  flight  hours  have  completed  the  assigned 
finite  life  or  when  a  crack  is  detected  by  currently 
available  means. 

Composite  components  are  never  as  pristine  as  metal 
components.  In  contrast  to  metals,  the  influence  of 
detectable  damage  in  composites  is  difficult  to  assess 
because  composites  often  exhibit  “cosmetic”  damage, 
which  should  not  be  the  basis  for  limiting  the  structural 
life  or  be  the  reason  for  redesign.  Thus,  for  a  composite 
part  to  be  retired,  the  damage  must  exhibit  structurally 
significant  delamination,  splintering,  matrix  cracking  and 
fiber  breakage. 


Corrosion  Fretting  &  Wear  Bearing  Flaws  Loss  of  Bolt 

(Galvanic.  {Manufacturing  Torque 

Atmospheric  &  &  Maintenance) 

Stress) 

Causes  of  Structural  Failures 


Fig.  6  Frequency  of  the  causes  of  the  structural  failures  of  Fig.  5  (Ref.  7) 
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Damage  Tolerance 

Damage  tolerance  is  defined  by  the  U.S.  Air  Force  in 
Reference  9  as, 

“Damage  tolerance  is  the  attribute  of  a 
structure  that  permits  it  to  retain  its  required 
residual  strength  for  a  period  of  unrepaired 
usage  after  the  structure  has  sustained 
described  levels  of  fatigue,  corrosion,  and 
accidental  or  discrete  source  damage  such  as 
(a)  unstable  propagation  of  fatigue  cracks,  (b) 
unstable  propagation  of  initial  or  service- 
induced  damage,  and/or  (c)  impact  damage 
from  a  discrete  source.” 

The  focus  in  this  definition  of  damage  tolerance  is  to 
quantify  the  level  of  damage  that  a  structure  can  tolerate 
and  retire  or  repair  it  before  a  catastrophic  failure  occurs. 
It  assumes  that  any  structure  is  essentially  imperfect  as  a 
result  of  tiie  “inherent  material  structure,  material 
processing,  component  design,  manufacturing  or  usage,” 
Ref.  10.  In  order  to  quantify  the  level  of  tolerable 
damage,  the  damage  must  be  assessed,  and  the  rate  at 
which  this  damage  will  propagate  and  the  damage  level 
at  which  the  residual  strength  will  fail  to  react  the  loads 
must  be  calculated.  The  principles  of  fracture  mechanics 
are  used  to  evaluate  the  damage  tolerance  of  a  structure, 
and  to  calculate  the  period  and  level  of  inspection 
required  to  mitigate  the  risk  of  failure. 

The  elements  of  the  procedure  for  calculating  the  time 
for  crack  initiation  and  the  rate  of  crack  propagation  for 
metals  are  applicable  to  composites.  The  difference, 
however,  is  in  inspection.  Inspection  is  a  subjective 
process,  and  assessing  “damage”  in  composites  is  more 
than  measuring  the  length  of  a  crack.  Therefore,  training 
should  maximize  on  the  inspector’s  experience,  the  type 
of  structure  and  material  in  order  that  the  damage 
criterion  for  composites  is  applied  uniformly. 

Fail-Safe 

Fail-Safe  as  defined  in  Reference  9  states 

“Fail-safe  is  that  attribute  of  the  structure  that 
permits  it  to  retain  its  required  residual 
strength  for  a  period  of  unrepaired  usage  after 
the  failure  or  partial  failure  of  a  Principal 
Structural  Element  (PSE)  ” 

A  PSE  is  an  element  of  the  structure  whose  integrity  is 
essential  for  maintaining  the  overall  structural  integrity 
of  an  aircraft.  Even  though  the  fail-safe  concept  states 
that  residual  strength  is  essential  to  achieve  redundancy, 
the  concept  does  not  develop  inspection  requirements  to 
monitor  damage.  Fail-safe  designs,  therefore,  provide 
multiple  load  paths  with  redundant  structures  such  that 
the  failure  of  one  load  path  will  safely  distribute  the 
applied  loads  to  other  load-carrying  members. 

Flaw  Tolerance 

The  flaw  tolerance  approach  is  based  on  the  premise  that 
flaws  exist  in  any  structure,  and  act  as  catalysts  for 


initiating  cracks.  The  flaw  tolerance  approach  advises 
inspection  and  recommends  that  a  component  be  retired 
after  the  prescribed  flight  hours  are  accumulated  or  when 
a  crack  is  found  in  inspection.  This  approach  does  not 
recommend  periodic  inspections  to  monitor  crack  growth 
or  subscribe  to  any  residual  strength  requirements. 
However,  it  does  require  the  maximum  tolerable  flaw 
sizes  in  critical  locations  be  determined  based  on 
historical  data.  The  data  on  the  size  and  the  location  of 
flaws  are  then  used  to  conduct  constant-amplitude 
fatigue  tests  of  flawed  specimens.  Replacement  times 
are  then  calculated  using  the  safe-life  approach.  This 
approach  is  also  known  as  “enhanced  safe-life,”  and  is 
“sometimes  used  in  combination  with  or  in  place  of* 
flaw  tolerance,  Ref.  1 1 . 


SUBSTANTIATION  METHODOLOGIES  FOR 
DYNAMIC  COMPONENTS 

All  components  subjected  to  oscillatory  loads  above  the 
endurance  limit  will  accumulate  damage,  which  result  in 
cracking  and  wear,  and  inevitable  failure.  The  helicopter 
manufacturers  have  tended  towards  two  methodologies 
depending  on  the  material  of  the  component,  its  design 
configuration,  its  load  spectrum  and  how  critical  is  its 
function  in  the  helicopter’s  operation.  The  two 
methodologies  are  safe-life  and  “extended  safe-life.” 
“Extended  safe-life”  is  a  new  terminology,  and  is  used  in 
this  context  to  represent  a  combination  of  flaw  tolerance 
and  damage  tolerance.  Included  in  the  extended  safe-life 
approach  are  features  of  the  fail-safe  approach  where 
multiple  load  path  designs  are  featured  in  critical 
structures.  The  features  of  the  four  traditional 
approaches  that  constitute  the  two  methodologies  are 
summarized  and  compared  in  Table  2.  The  extended 
safe-life  methodology  was  accepted  as  viable  by 
representatives  of  several  U.S.  helicopter  manufacturers 
represented  on  the  Fatigue  Methodology  Committee  of 
the  Rotorcraft  Advisory  Group  under  the  Civil  Aviation 
Council  of  the  Aerospace  Industries  Association,  Ref. 
12.  The  improved  substantiation  process  proposed  by 
Eurocopter,  Ref.  7,  encompasses  elements  of  (lie 
extended  safe-life  methodology  described  here. 

Safe-Life  Methodology 

Traditional  fatigue  tests  on  full-scale  components  are 
conducted  to  characterize  their  fatigue  behavior  in  the 
form  of  S-N  curves.  The  tests  are  conducted  on  as- 
manufactured  parts  and  are  subjected  to  constant 
amplitude  loads  based  on  measured  flight  loads.  The 
service  life  is  computed  with  a  high  safety  factor  based 
on  the  component  fatigue  strength.  The  high  safety 
factor  applied  to  as-manufactured  parts  has  to-date 
accommodated  the  strength-reducing  flaws  in  structures 
with  a  high  degree  of  reliability  as  shown  in  Figures  2 
and  5.  The  safe-life  methodology,  therefore,  assumes 
that  a  structure  has  a  finite  fatigue  life  which  can  be 
estimated  from  experimental  results  and  analysis.  The 
finite  life,  or  the  safe  service  life,  determines  the 
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Table  2  Summary  of  Substantiation  Methodologies 


Extended  Safe-Life 

Feature 

Safe-Life 

Damage  Tolerance 

Fail-Safe 

Flaw  Tolerance 

Focus 

•  Baseline  strength 

•  Strength  degrades 
in  service 

•  Level  of  tolerable 
damage  quantified 

•  Redundant  or 
multiple  load 
paths 

•  Maximum  flaw 
size  in  critical 
locations 

Retirement  Criterion 

•  Prescribed  flight 
hours  accumu¬ 
lated 

•  Crack  detected 

•  On-Condition,  i.e., 
damage  degrades 
residual  strength 
below  acceptable 
level 

•  Residual  strength 
below  acceptable 
level  when  a 
redundant  load 
path  fails 

•  Prescribed  flight 
hours  accumu¬ 
lated 

•  Crack  detected 

Structure 

•  Assumed  pristine 

•  Assumed  flawed 

•  Assumed  pristine 

•  Assumed  flawed 

Periodic  Inspection 
to  Assess  Criticality 
of  Crack 

•  No 

•  Yes 

•  No 

•  No 

Substantiation 

Methodology 

•  Traditional  fatigue 

•  Fracture  mechanics 

•  Traditional  fatigue 

•  Traditional  fatigue 
based  on  flawed 
specimens 

accumulated  flight  hours  allowed  before  a  part  is 
replaced  or  retired. 

The  basic  elements  of  the  safe-life  methodology  for 
metals  are  constant-amplitude  fatigue  tests  with 
accelerated  loading  to  develop  the  component  S-N  curve, 
standard  S-N  curve  shapes,  usage  spectrum  developed 
from  measured  flight  loads,  standard  safety  reduction 
factors,  and  Palmgren-Miner’s  Rule  of  linear  cumulative 
fatigue  damage.  In  the  case  of  composites  where  the  S-N 
shape  curve  is  typically  flatter  than  for  metals,  load 
excursions,  the  cycles  to  crack  initiation  and  the 
Palmgren-Miner’s  Rule  can  greatly  influence  the 
component  life  calculated  from  the  safe-life 
methodology. 

Composite  designs  are  generally  damage  tolerant. 
However,  because  the  S-N  shape  curves  of  composites 
are  flatter  than  of  metals,  they  are  sensitive  to  load 
excursions.  A  relatively  small  increase  in  load  results  in 
a  large  decrease  in  the  allowable  number  of  cycles  on  the 
S-N  curve.  If  this  load  increase  is  associated  with 
steady-state  flight  regimes  or  with  frequently  occurring 
maneuvers,  die  calculated  retirement  life  based  on  the 
safe-life  methodology  could  be  dramatically  reduced. 

The  safe-life  methodology  requires  a  component  be 
retired  when  a  crack  is  initiated.  In  composite  structures 
matrix  cracking  is  typically  the  damage  mechanism  that 
leads  to  delamination.  It  is  difficult  to  determine  when 
the  fatigue  strength  of  a  composite  structure  has 
significandy  degraded.  Since  the  number  of  cycles  to 
crack  initiation  is  plotted  to  estimate  the  service  life,  an 
error  in  plotting  it  on  a  comparatively  flat  S-N  curve  can 
result  in  a  greatly  erroneous  service  life. 


Since  the  S-N  curve  is  flatter  in  composite  structures, 
damage  is  generally  due  to  a  few  high  loads  in  the 
spectrum,  such  as  ground-air-ground  loads.  The  damage 
may  result  in  several  matrix  cracks  and  delaminations. 
The  number  of  cycles  to  failure  could  be  die  cumulative 
effect  of  their  initiation  and  propagation.  Since  the  load 
representing  the  cumulative  effect  is  difficult  to  quantify, 
Palmgren-Miner’s  rule  must  be  cautiously  applied. 

Extended  Safe-Life 

The  extended  safe-life  methodology  uses  a  combination 
of  flaw  tolerance  and  damage  tolerance  approaches. 
Component  replacement  times  are  calculated  using  the 
traditional  safe-life  approach  with  full-scale  fatigue  tests 
on  specimens  with  flaws  representative  of  defects  that 
occur  in  manufacturing  and  in  service.  However,  in 
addition  to  establishing  failure,  die  tests  monitor  crack 
growth  to  failure.  Damage  tolerance  principles  then 
establish  inspection  periods  for  cracks  and  to  evaluate 
degradations  in  fatigue  or  quasi-static  strengths.  By  this 
combination  of  approaches,  parts  can  not  only  be  retired 
when  loss  of  function  occurs  but  component  service  life 
can  be  increased  when  validated  by  inspection. 

The  flaws  intentionally  inflicted  on  specimens  are  the 
maximum  probable  flaw  sizes  determined  from  historical 
data  from  manufacture  and  service.  In  order  to  establish 
inspection  procedures,  damaged  areas  must  be  accessible 
during  service,  and  cracks  must  be  detectable  and 
measurable  by  the  mediod  and  tools  that  will  be  used  to 
perform  this  inspection.  The  accurate  determination  of 
the  initial  damage  size  and  its  propagating  length  must 
take  into  account  the  experience  and  training  of  the 
personnel  who  will  be  performing  the  inspection.  This 
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approach,  therefore,  promotes  user-friendly  designs  for 
operators  and  maintenance  institutions. 

In  order  for  this  methodology  to  provide  even  higher 
reliability  and  to  significantly  reduce  accidents, 
components  and  sub-assemblies  can  be  designed  with 
multiple  load  paths  and  to  provide  easy  access  for 
inspection  in  critical  locations  where  tests  have  indicated 
that  damage  will  occur.  As  a  standard  procedure,  the 
extended  safe-life  approach  establishes  replacement  or 
retirement  lives  of  principal  structural  components. 
Components  are  designed  to  be  tolerant  to  flaws,  to 
propagate  cracks  slowly,  and  to  provide  redundant  load 
paths  in  critical  structures.  These  features,  together  with 
planned  inspections  to  assertain  that  crack  sizes  are 
below  acceptable  limits  for  components  to  perform  their 
stated  functions,  will  assure  that  components  will 
successfully  react  the  spectrum  of  operating  loads  until 
the  next  inspection  period.  This  approach  is  applicable 
to  metals  and  composites. 


AIRFRAME  SUBSTANTIATION  PROCEDURES 

Metal  and  composite  airframes  are  designed  to  meet 
crashworthiness  and  ballistic-tolerance  requirements. 
These  static  requirements  establish  the  static  design 
criteria  where  the  static  limit  loads  exceed  the 
operational  oscillatory  loads  by  a  large  margin.  Rotor¬ 
generated  oscillatory  loads  in  helicopter  airframes  are 
also  significantly  below  the  loads  from  these  static 
requirements.  Low-cycle  airframe  fatigue  loads  from 
normal  landings  and  maneuvers,  although  higher  than 
rotor-generated  oscillatory  loads,  are  still  well  below  the 
static  design  criteria. 

Metallic  structures,  with  high  stress  concentration  areas, 
generally  have  low  fatigue  endurance  limits  compared  to 
their  static  ultimate  strengths.  Composites,  on  the  other 
hand,  with  flatter  fatigue  S-N  curve  shapes  and  low 
fatigue  sensitivity  to  stress  concentrations,  tend  to  have 
relatively  high  fatigue  endurance  limits  in  tension- 
dominated  modes  compared  to  their  static  ultimate 
strengths.  Experience  has  shown  that  a  composite 
airframe  with  good  static  strength  will  have  high  fatigue 
strength  margins.  This  means  that  a  fatigue  test  of  a  full- 
scale,  composite  airframe  may  not  be  necessary  provided 
that  analysis,  based  on  a  building  block  approach, 
validates  that  the  oscillatory  loads  do  not  exceed  the 
endurance  limits. 

Full-scale  fatigue  tests  of  the  airframe  must  be  conducted 
when  detail  analysis  cannot  be  corroborated  by  test  in 
highly  loaded  areas  or  when  the  load  path  is  complex.  In 
these  cases,  the  test  may  be  on  the  full  airframe  or  a 
major  sub-assembly  of  the  airframe.  Occurrences  of  a 
large  number  of  high  oscillatory  loads,  large  out-of-plane 
loads,  highly  loaded  complex  joint  configurations  in 
major  bulkheads  or  when  the  effects  of  loads  are  not 
known  are  all  reasons  for  conducting  full-scale  airframe 
tests.  Additionally,  any  airframe  designed  for  repeated 


heavy  lift  missions  are  candidates  for  full-scale  airframe 
fatigue  tests. 

In  the  manufacture  of  the  helicopter  airframe,  a  large 
number  of  flaws  may  be  permitted  in  order  to  reduce  the 
costs  of  production,  inspection,  and  rework.  Since 
composites  are  inherently  damage  tolerant,  any  damage- 
tolerant  features  in  airframe  design  only  enhances  the 
fail-safety  of  composite  construction.  A  “no-growth” 
qualification  on  this  basis  requires  a  low  strain  level  that 
further  reduces  the  possibility  of  generating  fatigue 
damage  or  propagating  flaws. 

The  presence  of  a  crack  or  a  flaw  in  an  airframe  structure 
does  not  preclude  it  from  being  airworthy.  However,  in 
order  to  demonstrate  airworthiness,  a  full-scale  test  under 
representative  loads  may  be  necessary.  Cracks  in  metal 
structures  or  delaminations  in  composite  structures  may 
be  acceptable  if  the  flaw  growth  rate  or  the  rate  at  which 
new  cracks  appear  in  adjacent  structures  are  deemed 
inconsequential  to  the  overall  structural  integrity. 

As  an  example,  the  fatigue  test  on  the  all-composite 
tailboom  for  Boeing’s  MD  5(X)N  helicopter  produced 
two  unexpected  benefits.  Very  early  in  the  tests,  cracks 
developed  in  an  area  subjected  to  high  out-of-plane 
bending  loads.  The  locations  of  the  cracks  confirmed  the 
high  strains  predicted  by  finite  element  analysis.  The 
growth  of  the  cracks  was  monitored  and  found  to  be 
arrested  after  an  additional  225  simulated  hours  of  flight. 
No  further  growth  was  measured  after  4,100  simulated 
flight  hours  and  two  applications  of  enhanced  limit  load. 
The  test  validated  the  crack  to  be  benign  and  detectable, 
and  was  used  to  establish  a  safe  inspection  interval,  Ref. 
12.  A  field  repair  was  then  designed  and  tested  on  the 
same  test  article  for  the  duration  of  the  fatigue  test.  The 
repair  procedure  was  qualified  for  field  application  and 
inspection  procedures  established. 

A  damage  tolerance  approach  to  the  design  of  helicopter 
airframes  is  almost  always  chosen,  and  composite 
construction  makes  this  an  even  more  advantageous 
choice.  The  full-scale  fatigue  test  must  take  into  account 
the  material  and  operational  variability  while 
demonstrating  structural  integrity.  The  variability  may 
be  demonstrated  by  (1)  a  test  conducted  under 
environmental  conditions;  (2)  applying  a  scatter  factor  to 
the  fatigue  test  time;  (3)  multiplying  the  test  loads  by  a 
load  enhancement  factor  (LEF);  or  (4)  a  combination  of 
all  three. 

The  full-scale  fatigue  test  for  Boeing’s  MD  500N 
tailboom  was  conducted  under  hot-wet  conditions  using 
an  LEF  of  1.18  and  a  scatter  factor  of  2  on  life.  The 
tailboom  was  soaked  for  30  days  at  85  percent  relative 
humidity  and  a  temperature  of  71°C  before  the  test.  If  a 
lower  load  enhancement  factor  were  selected,  the  test 
duration  would  have  been  longer.  If  the  failure  mode  is 
unknown  or  there  is  more  than  one  failure  mode,  the 
highest  applicable  LEF  must  be  used  in  order  that  all 
possible  failure  modes  are  considered.  However,  the 
selected  LEF  must  not  be  so  large  where  high  deflections 
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result  in  false  failure  modes.  In  tests  of  metal  airframes, 
LEFs  are  generally  not  used.  When  testing  a  composite 
or  a  composite-cum-metal  airframe,  a  high  LEF  must  be 
carefully  chosen  in  order  to  avoid  qualifying  an  over- 
designed  structure  or  recommending  early  retirement  or 
repairing  the  airframe  during  the  test.  The  airframe  must 
be  analyzed  in  detail  for  overloads  and  high  local 
residual  stresses  in  order  to  select  the  appropriate  LEF. 
This  methodology  is  based  on  that  developed  for  fixed- 
wing  aircraft.  Ref.  13. 

The  size  of  the  airframe  for  the  full-scale  test  may  make 
moisture  and  temperature  conditioning  impractical.  A 
combined  test  and  analysis  procedure  is  then  used.  The 
full-scale  static  test  article  is  instrumented  at  critical 
locations  where  the  measured  strain  can  correlate  the 
finite  element  analysis.  Once  the  correlation  between  the 
test  and  the  finite  element  model  has  been  established, 
the  maximum  strains  for  all  the  critical  loading 
conditions  can  be  calculated.  The  maximum  strains  are 
then  compared  to  the  material  allowable  data  to  validate 
the  structural  integrity  of  the  airframe  design. 


AGING  AIRCRAFT  ISSUES  FOR  FIXED-WING 
AIRCRAFT  AND  HELICOPTERS 

As  stated  in  the  introduction,  aging  aircraft  concerns 
were  brought  to  the  public’s  attention  when  the  Aloha 
accident  occurred  in  1988.  This  type  of  problem  could 
be  expected  in  the  civilian  fixed-wing  fleet  because  of 
the  number  of  aircraft  operating  and  the  many  hours  that 
these  aircraft  fly.  Although  structural  aging  problems 
could  be  thought  of  as  those  relating  to  years  in  service, 
they  can  also  be  attributed  to  the  cumulative  effect  of 
cyclic  loading  during  operation.  From  the  context  of 
structural  integrity,  the  fixed-wing  fleet  has  identified 
corrosion  and  wide-spread  fatigue  damage  (or,  multi-site 
damage)  as  the  two  primary  aging  aircraft  issues.  The 
civilian  fleet  has  an  advantage  over  the  military  fleet  in 
that  replacement  of  older  aircraft  is  more  likely  than  in 
the  military  fleet  where,  since  the  end  of  the  cold  war, 
the  military  has  continued  to  cut  back  their  acquisitions, 
and  aircraft  are  now  expected  to  remain  in  service  for  as 
long  as  50  years  (see  Table  1). 

Although  the  FAA  addressed  the  aging  problem  issues  as 
early  as  1968,  Ref.  14,  with  new  procedures  issued  in 
1978  for  maintaining  the  safety  of  aircraft  as  they  age,  it 
was  not  until  the  Aloha  accident  that  a  national  program 
was  developed  to  study  in  detail  the  problems  associated 
with  aging.  Along  with  several  conferences  that  focused 
on  aging  issues  and  several  prominent  research  programs 
that  have  come  into  existence,  an  Aging  Aircraft  Task 
Force  (AATF)  was  formed.  An  independent  advisory 
panel.  Technical  Oversight  Group  for  Aging  Aircraft 
(TOGAA),  was  appointed  to  continuously  review  the 
aircraft  industry  and  airlines.  TOGAA  began  their 
review  of  the  helicopter  civilian  fleet  in  1994.  At  one  of 
the  industry  and  FAA  review  meetings  in  1995  the 
helicopter  industry  stated  that  "aging  is  not  a  significant 


issue  for  rotating  parts  because  they  are  replaced  or 
extensively  refurbished  on  a  periodic  basis"  as  a  result  of 
the  safe-life  design  philosophy.  Even  though  TOGAA 
agreed  with  tins  statement,  the  helicopter  community 
would  consequently  state  that  issues  such  as  corrosion 
and  multi-site  damage  are  fatigue  phenomena  that  do 
occur  in  helicopters. 

Corrosion  is  a  problem  that  obviously  occurs  on  most 
metal  structures  that  operate  in  a  salt  or  moisture 
environment.  As  to  the  second  primary  aging 
phenomenon  of  multi-site  damage,  known  as  MSD  in  the 
fixed-wing  community,  different  experiences  seem  to 
exist  depending  on  the  operation  of  the  helicopter.  If 
MSD  does  occur  it  is  often  more  an  economic  concern 
for  helicopters  in  repairing  these  multiple  damages  rather 
than  a  safety  issue.  Quite  the  reverse  is  the  case  with 
fixed-wing  aircraft.  While  there  are  some  obvious 
differences  in  aging  problems  between  helicopter  and 
fixed-wing  aircraft  structures,  there  are  also  some 
similarities.  These  differences  and  similarities  on 
corrosion,  MSD,  structural  inspections,  loads  monitoring, 
and  the  separate  problems  associated  with  military  and 
civilian  operator  are  discussed  below. 

Corrosion 

It  is  obvious  that  corrosion  is  a  problem  for  both  the 
fixed-  and  rotary-wing  aircraft  since  both  are  still 
predominately  metal  structures.  Since  many  aircraft 
operate  around  a  salt  water  environment  (U.S.  Navy, 
U.S.  Coast  Guard,  and  helicopter  operators  of  off-shore 
oil  platforms  in  the  North  Sea  and  the  U.S.  Gulf  Coast), 
the  corrosion  problem  requires  constant  vigilance  in  both 
preventing  corrosion  and  repairing  corrosion  damage. 
Currently  no  mathematical  model  exists  that  can  predict 
the  rate  of  accumulation  of  corrosion.  In  fact  because  of 
the  many  variables  that  effect  the  accumulation  of 
corrosion  (mostly  where  the  rotorcraft  is  being  used),  it 
is  probably  not  possible  to  predict  the  accumulation  of 
corrosion  without  a  usage  monitoring  system  such  as  a 
Health  and  Usage  Monitoring  System  (HUMS)  unit. 
With  a  usage  monitoring  system  capable  of  tracking 
corrosion  as  it  accumulates,  an  on-board  computer  could 
predict  the  life  of  a  fatigue  crack  propagating  in  the 
corrosive  environment.  The  technology  to  predict 
fatigue  crack  growth  in  a  known  corrosive  environment 
exists  today. 

As  is  the  case  with  the  fixed-wing  community,  a 
computer  database  that  reflects  all  of  the  experiences  of 
rotorcraft  in  a  corrosive  environment  is  not  available 
today.  The  U.S.  Coast  Guard  has  developed  a  limited 
database  two  years  ago.  In  fixed-wing  military 
operations  where  the  U.S.  Air  Force  has  been  tracking 
structural  problems  through  their  Aircraft  Structural 
Integrity  Program,  ASIP,  since  the  early  70’ s,  a  database 
on  corrosion  problems  has  been  recorded  prior  to  1990 
for  only  the  KC-135  aircraft.  The  KC-135  has  been  in 
operatic*!  for  40  years,  and  there  is  no  obvious  date  for  it 
to  end  service,  which  is  another  example  of  how  military 
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aircraft  will  continue  to  age.  Since  the  military  had  not 
planned  on  keeping  aircraft  in  service  for  such  extensive 
periods,  aging  considerations  were  not  considered  in 
their  original  designs.  Also,  many  of  these  aircraft  were 
designed  in  the  1950’s  with  materials  that  are  more 
susceptible  to  corrosion  than  currently  available 
materials.  This  problem  is  illustrated  in  the  case  of  a 
main  rotor  grip  on  an  "older”  helicopter  that  was  made  of 
2014-T6  aluminum  alloy.  Fig.  7.  After  corrosion 
problems  occurred,  the  material  was  changed  to  7075- 
T73  aluminum  alloy  which  offers  greater  resistance  to 
stress  corrosion,  Ref.  15.  One  design  concept  that  occur 
in  all  airframe  structures  that  lead  to  corrosion  is  the  lap 
splice  joint  in  fuselage  skin  construction.  The  area  of  the 
lap  joint  has  been  shown  to  initiate  and  accumulate 
corrosion.  The  lap  splice  joint  problem  can  be 
selectively,  though  not  completely,  eliminated  in 
helicopter  airframes.  The  joint  is  more  extensively  used 
in  fixed-wing  aircraft. 

One  weakness  that  can  cause  problems  in  helicopters  that 
does  not  occur  in  most  fixed-wing  aircraft  concerning 
corrosion  is  the  safe-life  design  methodology. 
Traditional  safe-life  does  not  account  for  any  deviation 
in  fatigue  strength  that  may  occur  over  time  (aging)  due 


to  flaws  or  corrosion  that  develop  during  manufacturing, 
maintenance  or  service.  However,  in  1988  for 
helicopters  the  flaw  tolerance  design  methodology  was 
added  to  the  Federal  Air  Regulation  to  help  alleviate  this 
short-coming  of  the  traditional  sale-life  design  method. 
Several  approaches  can  be  taken  to  modify  the  safe-life 
methodology  after  the  helicopter  has  entered  service. 
These  are  illustrated  below. 

In  the  case  of  the  structural  life  management  of  a 
horizontal  hinge  pin  for  the  CH-53  A/D  helicopter, 
which  had  been  an  out-of-production  U.S.  Navy 
helicopter,  a  study  of  the  conditions  that  can  reduce 
structural  integrity  was  undertaken  in  order  to  extend  the 
life  of  this  component.  Ref.  16.  The  horizontal  hinge  pin 
is  made  of  4340  steel  and  had  experienced  corrosion 
problems  during  its  service  life.  Using  flaw  tolerance 
concepts  a  coupon  test  program  was  developed  using  a 
"worst  case"  corrosion  pit.  The  coupon  specimens  were 
tested  in  fatigue  and  showed  a  63%  reduction  in  fatigue 
strength.  Fig.  8.  This  study  set  die  inspection  interval  at 
1,200  hours,  which  coincided  with  a  scheduled  overhaul 
and  which  allowed  regular  inspections  up  to  its  normal 
retirement  time  of  8,300  hours. 


Fig.  7  Main  rotor  grip  where  corrosion  was  mitigated  by  replacing  the  aluminum  alloy  (Ref.  15) 
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Fig.  8  Effect  of  corrosion  on  the  S-N  curve  of  the  CH-53  A/D  horizontal  hinge  pin  (Ref.  16) 


A  second  example  was  the  tail  rotor  pitch  horn  of  the  S- 
76  helicopter,  Ref.  16.  This  component  also  experienced 
corrosion.  The  pitch  horn  is  made  of  an  aluminum  alloy 
with  a  22,000-hour  retirement  life.  A  "worst  case" 
condition  was  used  to  evaluate  failure  due  to  corrosion, 
Fig.  9.  In  this  case,  instead  of  using  inspections  to 
monitor  the  structural  integrity  of  the  pitch  horn,  its 
retirement  life  was  reduced  to  12,000  hours.  This 
decision  was  based  on  the  fact  that  some  corrosion  had 
been  seen  to  occur  on  all  pitch  horns  that  had  been 
inspected. 


Where  corrosion  is  a  problem,  extreme  vigilance  must  be 
exercised  to  prevent  the  problem  from  becoming  severe 
and  requiring  extensive  repairs.  Evidence  of  this  severity 
has  been  seen  in  the  civilian  fixed-wing  fleet.  This 
situation  is  often  aggravated  when  aircraft,  subjected  to 
short-term  changes  of  ownership  or  operators,  do  not 
appear  to  receive  adequate  maintenance 

Multi-Site  Damage 

Multi-site  damage,  also  allied  wide-spread  fatigue 
damage,  occurs  in  structures  with  "similar  details 
operating  at  similar  stresses  where  structural  capability 
could  be  affected  by  the  interaction  of  similar  cracks." 
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In  fixed-wing  aircraft  typical  structures  where  MSD 
could  occur  would  be  wings  and  empennages  with 
chordwise  splices  and  rib-to-stiffener  attachments.  This 
type  of  damage  is  also  common  in  fuselages  with  lap 
splice  joints.  Generally  in  the  fuselages  of  fixed-wing 
aircraft  and  helicopters,  with  all  the  rivet  holes,  lugs,  and 
other  fittings,  MSD  is  very  likely  to  occur  in  several 
locations.  MSD  is  less  a  safety  issue  in  helicopters  than 
for  fixed-wing  aircraft  because  of  the  pressurized  cabins 
found  in  the  transport  civilian  fleet.  When  a  series  of 
small  cracks  link  up  to  form  one  large  crack  in  the 
structure  of  a  pressurized  cabin,  the  extra  energy  released 
could  be  a  serious  safety  hazard  that  would  not  occur  in 
the  non-pressurized  fuselages  of  helicopters.  This  was 
the  situation  in  the  structural  damage  suffered  by  the 
Aloha  aircraft  in  1988  where  the  safety  of  the  aircraft 
was  jeopardized. 

It  appears  that  even  though  MSD  has  not  been  a  safety 
issue  in  helicopters,  general  cracking  is  observed  more 
and  more.  This  is  one  area  of  concern  where  regular 
inspections  can  be  of  great  value.  In  Reference  7, 
Eurocopter  estimates  that  about  20  accidents  and  major 
incidents  over  43  million  flight  hours  could  have  been 
avoided  by  periodic  inspections  of  the  helicopters.  If 
fleet  surveys  of  problems  are  systematically  recorded, 
trends  can  be  identified  and  major  structural  failures  can 
be  avoided  in  the  future.  If  multiple  cracking  is  found 
early  through  inspection,  modifications  can  be  made  and 
catastrophic  conditions  can  be  preempted  from 
developing.  The  military  believes  that  helicopter 
airframes  are  not  “tracked”  as  well  as  the  dynamic 
components.  Since  airframes  are  the  structures  where 
MSD  is  most  likely  to  develop,  some  type  of  tracking 
(inspection)  program  should  be  instituted  to  preclude 
much  larger  and  expensive  solutions  later  in  service. 

One  example  where  a  cracking  problem  like  MSD  has 
been  noted  is  in  the  Royal  Navy’s  EH- 101  helicopters, 
Ref.  17.  During  an  extensive  fatigue  test  program  cracks 
were  noticed  to  form  in  the  rear  fuselage  where 
conventional  skin-stringer  designs  are  used.  This  part  of 
the  airframe  was  identified  as  one  to  be  managed  on  an 
"on-condition"  basis.  This  is  a  good  example  where  a 
thorough  initial  fatigue  test  program  has  identified  MSD 
and  developed  a  good  inspection  program  to  extend  the 
safe  service  life  of  the  EH- 101  helicopter. 

Programs  are  now  being  instituted  to  monitor  areas 
where  future  problems  may  occur  and  take  action  early 
to  mitigate  them  and  extend  component  service  lives.  A 
case  in  point  is  the  U.S.  Navy's  Helicopter  Integrated 
Diagnostic  System  (HIDS).  One  aspect  of  HIDS  is  to 
track  vibration  in  helicopters  in  order  to  maintain  smooth 
rotor  blade  operations  thus  reducing  fatigue-type  loads 
and  alleviate  cracking  problems  like  MSD. 

Loads  and  Usage  Monitoring 

Loads  and  usage  monitoring  is  one  of  the  key  technical 
topics  of  the  day.  It  makes  little  difference  how  exact  the 
life  prediction  model  is  if  the  magnitudes  of  the  loads  are 


not  known  or  are  inexact.  When  two  different  pilots  fly 
the  same  maneuver  on  the  same  helicopter  the  measured 
loads  can  differ  by  as  much  as  a  factor  of  two.  When  a 
syllabus  of  typical  maneuvers  were  flown  by  six  pilots 
on  the  same  helicopter,  the  average  coefficient  of 
variation  in  measured  loads  lor  all  maneuvers  was 
between  7  to  10  percentages.  Consequently,  in  order  to 
include  “unknown”  loads  in  the  loads  analysis  for 
calculating  the  safe  retirement  life,  only  the  top-of- 
scatter  loads  are  considered.  This  assumes  that  the 
maximum  load  measured  in  a  maneuver  occurs 
throughout  the  maneuver.  However,  the  loads 
experienced  by  a  structure  not  only  varies  from  aircraft 
to  aircraft  but  also  on  how  an  aircraft  is  flown.  Tims, 
part  retirement  based  on  average  aircraft  usage  is 
difficult  to  quantify.  Again,  as  aircraft  age,  the  operation 
of  individual  aircraft  are  increasingly  and  substantially 
different  from  the  average  of  the  whole  fleet,  and 
estimates  of  the  retirement  lives  of  components  based  on 
average  aircraft  usage  are  inadequate.  The  deterministic 
loads  and  allowable  used  in  safe-life  methodology  has 
also  been  attributed  for  the  frequent  inspections 
recommended  by  manufacturers.  A  probabilistic 
approach  has  been  suggested  for  a  more  efficiently 
managed  fleet. 

As  it  was  previously  noted  under  the  section  on  MSD,  a 
system  like  the  U.S.  Navy’s  HIDS  can  play  a  role  in 
loads  and  usage  monitoring.  Certainly  with  the  rapid 
advancements  in  algorithms,  sensors  and  computer 
technology  smaller  and  more  sophisticated  usage  and 
loads  monitoring  systems  are  now  available,  and  it  is 
expected  that  an  on-board  life  prediction  system  will 
soon  be  available  to  record  actual  loads  for  the  usage 
monitoring  system.  This  will  account  for  the  variation  in 
loads  caused  by  the  pilot’s  input.  In  the  case  of  the 
HIDS  system,  the  use  of  an  automated  diagnostic  system 
for  helicopters  has  been  shown  to  provide  early  warning 
of  damage  and  wear  before  the  occurrence  of  failure. 
This  has  been  demonstrated  by  the  U.S.  Navy  on  the 
drive  train  components  of  die  UH-60  helicopter  using 
HIDS,.  Ref.  18.  The  HIDS  system  is  designed  to  detect 
early,  and  monitor  die  progression  of,  incipient  “fault 
condition.”  Thereby,  the  healdi  of  a  component  can  be 
known  at  any  point  in  time,  the  accumulation  of  damage 
can  be  tracked  and  component  replacement  at  normal 
overhaul  times  on  aging  aircraft  can  be  effectively 
managed.  Thus,  HIDS  not  only  maintains  the 
helicopter’s  structural  integrity  but  also  improves 
availability  and  reliability  while  minimizing  cost  through 
scheduled  maintenance. 

The  variation  in  usage  from  aircraft  to  aircraft  occurs  not 
only  with  changing  requirements  of  the  operating  agency 
but  also  when  the  aircraft  is  operated  by  several 
agencies.  This  is  the  case  of  die  European  multi-nation 
Tornado  aircraft,  a  total  of  about  1000  of  which  have 
been  procured  by  three  nations  through  1997.  It  was 
originally  conceived  as  a  low-level  strike  and 
reconnaissance  aircraft.  With  diree  different  nations 
using  this  aircraft,  the  Tornado  is  now  a  muld-role 
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aircraft  and  loads  are  accumulated  at  rates  different  from 
the  original  design  spectrum.  This  example  is  typical  of 
the  dilemma  faced  by  all  aircraft  manufacturers. 

Nondestructive  Inspection  and  Reliability 

Perhaps  the  most  important  aspect  of  assuring  structural 
integrity  in  aging  aircraft  and  yet  probably  the  weakest 
link  is  that  of  identifying  and  locating  damage  through 
the  use  of  nondestructive  inspection  (NDI)  methods.  If 
the  service  life  of  an  aircraft  is  extended,  damage  is 
inevitable,  which  must  be  detected  reliably  and  repaired 
properly.  Often,  it  is  not  a  matter  of  how  small  a  damage 
can  be  located,  but  how  reliably  can  such  small  areas  of 
damage  be  found.  For  most  metal  structures,  this 
damage  is  either  corrosion  or  a  crack.  The  question  in 
NDI  is  not  how  small  a  crack  can  be  detected,  but  how 
large  of  a  crack  can  be  missed  from  being  detected. 

In  the  technology  of  managing  structural  life  through 
inspections  the  U.S.  Air  Force  has  the  most  experience 
since  its  formal  adoption  of  the  ASIP  program  when 
MIL- HDBK- 1530,  Ref.  9,  was  published  in  1972.  In 
regard  to  a  crack  size  that  can  be  detected  with  a  high 
degree  of  reliability,  the  Air  Force  in  its  damage 
tolerance  design  philosophy  uses  a  roque  flaw  (the 
largest  flaw  likely  to  exist)  of  1.27  mm  as  its  standard  in 
fixed-wing  aircraft.  In  regard  to  how  small  a  crack  must 
be  found  in  helicopters  to  insure  their  structural  integrity, 
crack  sizes  of  the  order  of  about  0.4  mm  are  often 
quoted.  While  some  sources  suggest  that  eddy  current 
can  locate  cracks  of  these  sizes  fairly  reliably,  others 
have  found  that  the  smallest  crack  that  can  be  detected 
with  a  high  degree  of  reliability  is  0.8  mm.  Reliable 
crack  detection  is  of  prime  importance  as  the  rotorcraft 
community  attempts  to  move  towards  a  life  management 
system  based  on  extended  safe-life  of  its  structures.  In 
the  current  environment  of  mostly  safe-life  designs,  the 
rotorcraft  community  is  limited  in  its  ability  to  manage 
aging  helicopter  structures  because  the  Palmgren-Miner’s 
rule  in  safe-life  methodology  does  not  physically  model 
the  initiation  and  growth  of  a  crack.  Some  sources  even 
believe  that  a  0.4  mm  initial  crack  size  is  too  large  for 
damage-tolerant  designs  of  helicopter  components  and 
that  crack  sizes  as  small  as  0.2  mm  must  be  the  design 
basis.  What  is  important  is  reliable  detection  of  any 
crack  in  the  prevailing  environment  under  which  the 
inspection  is  conducted.  As  the  helicopter  community 
continues  to  design  affordable  structures  to  damage 
tolerance  and  to  stringent  weight  requirements,  it  is 
obvious  that  increasingly  small  cracks  are  required  to  be 
reliably  detected.  To  increase  the  reliability  of  detecting 
cracks,  automated  inspection  systems  are  required  to 
eliminate  the  human  error  in  reading  and  interpreting 
results.  Nondestructive  inspection  methods  and 
acceptance/failure  criteria  are  described  in  greater  detail 
below. 


The  Aging  Problem  of  Military  Aircraft 

From  statements  made  above  and  as  shown  in  Table  1, 
the  military  aging  problem  is  much  more  severe  than  that 
of  the  civilian  fleet.  In  the  case  of  military  aircraft,  it  is 
becoming  increasingly  difficult  to  justify  the  budget  to 
regularly  replace  the  military  fleet.  The  military  has  also 
not  been  able  to-date  to  develop  a  database  of  aging 
aircraft  problems  in  order  to  identify  the  time  and 
rationale  when  structural  parts  of  a  helicopter  should  be 
replaced. 

In  the  U.S.  Army,  which  has  a  fleet  of  about  5,000 
helicopters,  the  Aircraft  Condition  Evaluation  (ACE) 
program  was  recently  initiated  to  re-engineer  older 
helicopters  to  as-new  condition.  This  program  has 
already  revealed  that  while  new  helicopters  have  time 
between  overhauls  of  1,000  hours  or  more,  older, 
refurbished  parts  often  have  only  a  few  hundred  hours 
between  overhaul.  It  is,  therefore,  not  cheaper  to 
maintain  older  helicopters  than  to  buy  new  ones  because 
evidence  shows  that  the  cost  of  maintaining  helicopters 
rises  continuously  with  the  age  of  the  helicopter.  A  case 
in  point  is  the  U.S.  Army’s  CH-47D  Chinook  helicopters 
which  are  re-engineered  and  refurbished  from  die  CH- 
47 A.  The  increasing  cost  for  maintaining  the  CH-47D 
helicopters  over  a  period  of  nine  years  is  shown  in  Fig. 
10,  Ref.  1.  As  the  hours  of  operation  of  a  helicopter 
increases,  the  military  budget  is  doubly  penalized  widi 
higher  operation  and  support  (O&S)  cost  and  higher 
maintenance  cost  because  the  helicopter  is  further  aged. 
The  O&S  cost  for  CH-47D  helicopters  in  terms  of  flight 
hours  is  shown  in  Fig.  11,  Ref.  1. 

The  U.S.  Army  continues  to  maintain  its  helicopter  fleet 
with  a  safe-life  design  philosophy.  If  cracks  occur,  the 
problems  are  often  managed  using  a  damage- tolerant 
inspection  procedure.  However,  if  the  component  that  is 
experiencing  these  problems  is  redesigned,  die  service 
life  is  again  calculated  on  die  basis  of  the  safe-life 
approach.  The  Army  is  considering  adopting  more  and 
more  damage  tolerance  types  of  procedures,  but  the  cost 
and  reliability  of  NDI  remain  die  principle  barrier  for 
wider  use  of  the  damage  tolerance  methodology.  The 
remoteness  of  some  deployment  sites  and  the  use  of  the 
foot  soldier  for  inspections  are  two  reasons  why  the 
Army  considers  the  damage  tolerance  approach  to  be  too 
risky  at  present. 

The  U.S.  Navy  also  has  an  aging  fleet  of  helicopters, 
widi  the  average  age  of  about  19  years,  Fig.  1.  The  Navy 
expects  to  alleviate  the  aging  issue  through  an  aggressive 
replacement  program  starting  in  2(X)5;  however,  the  rate 
of  acquisition  will  depend  on  the  available  budget.  The 
Navy’s  procedures  for  managing  dieir  fleet  are  almost 
die  same  as  die  U.S.  Army’s  structural  life  management 
philosophy.  That  is,  the  safe-life  methodology  sets 
retirement  times.  In  case  of  failure,  damage  tolerance 
principles  are  used  to  address  problems  in  the  field  while 
a  safe-life  redesign  is  undertaken  to  increase  die  service 
life  of  the  component,  Ref.  3.  The  U.S.  Navy  is  not  too 
encouraged  widi  the  damage  tolerance  approach  because 
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of  the  difficult  environment  in  which  it  operates,  and 
because  shipboard  inspection  is  often  undertaken  by 
seamen  without  extensive  experience.  Ref.  2. 

The  U.S.  Air  Force,  while  desiring  to  move  towards  a 
damage  tolerance  philosophy  for  helicopters  because  of 
the  successful  application  of  its  ASIP  program  to  its 
fixed-wing  fleet,  has  depended  on  the  Army  for  its 
structural  integrity  methods  because  its  fleet  of 
helicopters  is  small. 


NDI  AND  ACCEPTANCE/FAILURE  CRITERIA 


Overview 


It  has  been  discussed  above  why  application  of  damage 
tolerance  principles  are  being  inhibited  by  the  cost  and 
reliability  of  NDI  methods.  This  section  describes  the 
NDI  methods  for  composites  structures;  the  same 
principles  are  generally  applicable  to  metallic 
components.  Composite  structures  are  more  difficult  to 
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inspect  because  they  are  made  of  non-homogeneous 
materials  and  are  manufactured  by  a  variety  of  processes 
each  with  its  specific  requirements  for  quality.  In 
addition,  special  attention  must  be  given  to  composite 
structures  in  order  that  internal  defects  or  damage  can  be 
detected  and  assessed.  In  metallic  materials,  flaws  are 
modeled  and  linear  elastic  fracture  mechanics  applied  to 
predict  failure.  Unfortunately  a  unified  failure  model  is 
still  under  development  for  liber-reinforced  composite 
materials.  Experimental  methods  for  detecting  internal 
flaws  in  composite  structures  and  comparing  the  flaws  to 
reference  standards  are  the  only  means  for  evaluating  die 
structural  integrity  and  the  residual  level  of  performance 
in  safety-critical  applications. 

Non -destructive  inspection  methods  identify 

manufacturing  and  in-service  defects  in  structures 
without  degrading  their  quality  or  affecting  their 
serviceability.  Defects  can  be  external  and  internal  to  the 
structure.  External  defects  can  lx*  visually  inspected, 
such  as  dimensions,  finish,  and  warpage.  Internal  defects 
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Fig.  10  Maintenance  man-hours  per  flight  hour  for  the  Chinook  helicopters  in  the  U.S.  Army's  inventory  (Ref.  1) 


Flight  Hours  Since  Conversion  to  D  Configuration 


Fig.  1 1  The  O&S  cost  of  Chinook  helicopters  with  respect  to  hours  of  operation  (Ref.  1) 
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of  most  concern  in  composites  are  delaminations, 
inclusions,  voids,  resin-rich  and  resin-starved  areas,  fiber 
misalignments  and  breakage,  and  debonds.  NDI  is  part 
of  quality  assurance  that  controls  the  manufacturing 
process  in  order  to  meet  design  specifications,  produce 
repeatable  products  and  reduce  cost. 

Composite  materials  are  made  of  two  constituents:  fibers 
for  strength  and  a  matrix  to  bind  the  fibers  to  shape. 
Defects  will  inevitably  occur  in  composite  structures. 
NDI  is  used  to  evaluate  the  criticality  of  the  defect(s), 
i.e.,  number,  size(s)  and  location(s).  The  implementation 
of  NDI  must,  therefore,  begin  during  design  by  arranging 
structural  details  to  facilitate  inspection,  and  with 
analyses  to  qualify  the  arrangements  and  identify  the 
critical  sizes  and  locations  of  defects  in  terms  of  the 
capabilities  of  the  available  techniques.  In  order  to 
conduct  NDI  efficiently  and  accurately,  reference 
standards  must  be  established  which  take  into  account 
the  design,  equipment,  die  minimum  defect  size  that  can 
be  detected,  types  of  defects  and  acceptance  criteria.  The 
acceptance  criteria  are  developed  through  destructive 
tests  and  analyses  to  quantify  the  criticality  of  defects  in 
a  flawed  structure. 

Types  of  Internal  Defects 

Internal  defects  typically  occur  due  to  variations  in  the 
material  from  batch  to  batch  and  due  to  the  variables  in 
die  manufacturing  process.  Most  defects  can  be  easily 
prevented  through  proper  process  control,  of  which  NDI 
is  an  integral  part.  The  internal  defects  of  most  concern 
for  manufacturers  of  composite  structures,  and  where 
NDI  alone  can  assess  the  “damage”  caused  by  these 
defects  in  order  to  assess  die  residual  level  of 
performance  are  described  in  Table  3  (Ref.  12). 

NDI  Methods 

The  integrity  of  composite  structures  is  evaluated  by 
identifying  (sizes  and  locations  of)  defects  using  NDI 
methods.  Several  NDI  methods  are  in  use,  but  none  of 
them  quantifies  the  integrity  of  the  structure.  The  results 
of  NDI  are  compared  with  drawing  specifications  and 
reference  standards  in  order  to  identify  the  sizes  and 
locations  of  defects.  A  structural  analysis  and  test 
program  then  quantify  the  integrity  of  the  structure. 
Descriptions  of  NDI  methods  are  available  in  several 
publications,  including  Ref.  19-25.  The  advantages  and 
disadvantages  of  the  more  widely  used  methods  are 
shown  in  Table  4  (Ref.  12),  and  their  efficacy  in 
detecting  delects  in  Table  5  (Ref.  12).  The  most 
common  methods  for  NDI  are  visual,  radiographic  and 
ultrasonic  inspections.  Specialized  inspection  methods 
are  used  lbr  specific  applications.  For  example,  Cat- 
Scan  has  been  used  to  inspect  alignment  and  compaction 
of  fibers. 

Acceptance  Criteria  for  Production  Parts 

Since  a  composite  structure  is  a  complex  assembly  of 
elements  made  from  several  material  types  and  forms,  it 


is  inevitable  that  defects  of  various  shapes  and  sizes  will 
be  present  in  production  parts.  During  the  design 
process  the  criticality  of  defects  are  analytically 
determined,  which  then  establishes  the  acceptance 
criteria.  The  acceptance  criteria  vary  widely  with  the 
type  of  defect,  the  structure  being  inspected  and  the  NDI 
method  used.  For  example, 

1)  the  acceptance  criteria  are  more  stringent  for 
primary  structures  than  for  secondary 
structures, 

2)  the  acceptance  criteria  for  voids  and  porosity 
can  be  given  in  terms  of  signal  attenuation 
for  ultrasonic  inspection  or  in  terms  of  linear 
dimension  and  area  when  radiography  is 
used,  and 

3)  the  limiting  area  of  acceptability  can  be  for 
individual  voids  or  lbr  an  envelope  around 
several  scattered  defects. 

Non-destructive  inspection  is  the  joint  responsibility  of 
engineering,  manufacturing  and  process  control  to  assure 
that  composite  structures  are  manufactured  to  a  quality 
consistent  with  the  design  requirements.  To  assure  early 
detection  of  defects,  specifications  of  acceptance  criteria 
for  each  NDI  method  are  documented  on  the  basis  of  the 
minimum  defect  size  that  can  be  detected.  However, 
these  documents  are  general  in  their  requirements,  and 
specific  criteria  for  primary  components  or  at  specific 
locations  are  included  in  engineering  drawings.  Specific 
locations  may  be  critical  because  they  are  in  highly 
stressed  areas  or  because  they  are  difficult  to  inspect. 

The  documents  on  general  acceptance  criteria  include  the 
acceptance  and  repairable  limits  and  the  repair 
procedure.  If  a  defect  can  be  repaired,  the  component  is 
directed  to  process  specifications  and  then  re-evaluated 
through  NDI.  Typical  acceptance  criteria  for  laminated 
structures  are  given  in  Table  6  (Ref.  12).  Since 
acceptance  criteria  are  based  on  manufacturing 
experience  and  are  peculiar  to  the  NDI  equipment  in  use, 
the  list  of  defects  given  in  the  tables  will  vary  and  their 
limits  may  be  refined  to  the  unique  capabilities  of  each 
manufacturer. 

The  acceptance  criteria  for  composite  sandwich 
structures  include  both  typical  detects  as  well  as  defects 
that  are  unique  to  the  designs  of  a  manufacturer.  The 
design  details  are  especially  important  for  composite 
components  of  the  rotor  system,  e.g.,  the  blades.  Since 
the  blade  is  constructed  to  meet  the  specifications  of 
static  and  fatigue  strengths,  stiffness,  and  the  distribution 
of  weight,  specific  details  of  blade  elements  -  the  spar, 
leading  edge,  trailing  edge  and  after-body  -  may  be 
separately  identified  in  the  acceptance  criteria.  The 
number  of  details  identified  depends  on  the 
manufacturing  method  used  for  the  blade  elements  and 
the  assembly  procedure  adopted.  Typical  acceptance 
criteria  for  defects  in  sandwich  structures  are  given  in 
Table  7,  Ref.  12. 
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Failure  Criteria  for  Development  Test 

Composites  under  inspection  will  always  indicate 
structural  defects  either  visually  or  by  NDI.  These 
defects  have  to  be  identified  as  structurally  significant 
before  further  substantiation  is  undertaken.  As  stated 
previously,  composites  are  inherently  flawed,  with  some 
level  of  each  of  these  flaws  acceptable  at  any  given 
location  of  the  component.  By  ‘‘acceptable,”  it  is  meant 
that  the  structural  integrity  of  the  component  is  not 
compromised  by  the  presence  of  the  flaw. 

The  declaration  of  a  structural  failure  then  must  be 
postponed  until  it  is  verified  that  the  observed  defect  can 
grow  to  be  unstable  to  the  point  where  structural  integrity 


is  affected.  In  safe-life  testing,  it  may  be  appropriate  to 
consider  the  initiation  point  as  the  number  of  test  cycles 
where  the  defect  was  first  observed  or  detected.  If  the 
defect  growth  is  arrested  and  component  structural 
integrity  is  not  reduced,  the  defect  can  be  declared  as 
“cosmetic”  and  ignored  in  analysis  and  in  service. 

In  extended  safe-life  testing,  the  initial  detectability  must 
be  defined  in  visual  terms  or  in  terms  of  one  of  the 
specific  methods  in  Table  4,  which  then  becomes  the 
standard  method  for  inspection  in  service.  The  rate  of 
growth  of  the  defect  is  then  monitored  in  the  test,  and  the 
equivalent  flight  hours  to  unstable  crack  length  is  used  to 
calculate  the  in-service  inspection  intervals. 


Table  3.  Descriptions  of  Defects  in  Composite  Structures  (Ref.  12) 


Defect 


Delamination 


Inclusions 


Fiber  Misalignment, 
Wrinkling,  Buckling 


Fiber  Breakage 


Fiber  Misalignment 


Description 


Delaminations  are  separations  within  plies 
of  a  laminate,  and  caused  by  improper 
surface  preparation,  contamination  and 
embedded  foreign  matter. 

Inclusions  are  foreign  matter  embedded  in 
and  between  laminae. 


Voids  and  porosity  are  entrapped  air  and 
gas  bubbles,  and  are  caused  by  volatile 
substances,  improper  flow  of  resin  and 
unequal  pressure  distribution.  Voids  are 
clustered  in  the  resin,  while  porosity  are 
pockets  within  the  solid  material.. 


Resin-rich  areas  tire  localized,  and  filled 
with  resin  or  lacking  in  fiber.  This  defect 
is  caused  by  improper  compaction  or 
bleeding. 


De-bond 


Fiber  misalignment  is  a  distortion  of  the 
plies  resulting  in  changes  from  the  desired 
orientation,  or  in  fiber  wrinkling  and 
buckling.  These  defects  are  due  to 
improper  lay-up  and  cure. 


Broken  fibers  are  discontinuous  or 
misplaced  fibers  due  to  improper  handling 
or  lay-up. 


De-bonds  occur  between  different  details 
of  the  built-up  structure.  Lack  of  bonding 
is  due  to  contamination  of  the  surface, 
excessive  pressure  or  bad  fit. 
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Table  4.  Efficiencies  of  NDI  Methods  for  Composites  (Ref.  12) 


NDI  Method 

Application 

Advantages 

Disadvantages 

Visual 

1 .  Surface  defects 

1.  Simple 

2.  Economical 

1 .  Limited  information 

2.  Surface  delects,  finish 

Coin  Tap 

1 .  Large  voids,  debonds 
and  delaminations 

1 .  Simple 

2.  Economical 

1 .  Limited  information 

2.  Difficult  with  very  large 
structures. 

Radiographic 

1.  Internal  defects  in 
sandwich  structures 

2.  Edge  delamination  and 
damage 

1 .  Easy  to  use 

2. Equipment  readily  available 

3.  Extensive  information  on 
the  state  of  damage 

4.  Permanent  record 

1.  Radiation  safety  concern  s. 

2.  Relatively  expensive 

3.  Penetrant  required 

4.  All  damages  (thin  Haws 

perpendicular  to  the  beam) 
may  not  be  detected. 

Ultrasonic  1 .  Voids  and  porosity  1 .  Very  accurate  results  1  Slow  operation 

(C-Scan)  2.  Delaminations  2.  Relatively  low-cost  process  2.  Couplant  medium  needed 

3.  Permanent  record  3.  Bulky,  relatively  expensive 

4.  Thick  structures  equipment 

5.  Can  be  automated  4.  Difficulty  with  complex 

_ geometry  (core,  etc.) _ 

Acoustic  1.  Delaminations  and  voids  1.  Higher  resolution  than  C-  1.  Limited  to  small  areas 

Ultrasonic  2.  Fiber  breakage  scan.  2.  Dependent  on  surface 

3.  Fiber-matrix  interface  2.  Quickly  evaluates  for  geometry  since  the  medium 

4.  Fiber  orientation  acceptance  or  rejection  is  the  structure 

_  3.  Permanent  record. _ 

Thermographic  1.  Delaminations  and  voids  1.  Simple  system  1.  Experience  required  to  size 

2.  Debonds  2.  Quantitative  results  and  type  of  defect 

3.  Real-time  images  2.  Limited  size  of  structure 

4.  Surface  contact  not  3.  Thin  specimens  only 

required. _ 


Acoustic  1 .  All  defects  1 .  Continuous  monitoring  1 .  Structure  is  under  load 

Emission  2.  Global  2.  Voluminous  data 

3.  Simple  geometry _ 


Holographic 

1.  Delaminations  and  voids 

2.  Core-to-skin  de-bonds 

1 .  Rapid  evaluation 

2.  Relatively  inexpensive 

3.  Surface  preparation  not 
required 

4.  Permanent  record 

5.  Real-time  image 

1 .  Sensitive  to  vibration  if  not 
coupled 

2.  Optically  accurate 
alignment  required 

3.  Laser  safety  concerns 

Shearographic 

1 .  Delaminations  and  voids 

2.  Impact  damage 

3.  Cracks  in  holes 

4.  De-bonds 

1 .  Rapid  evaluation 

2.  Relatively  inexpensive 

3.  Portable  equipment 

4.  On-aircraft  inspection 

5.  Permanent  record 

6.  Real-time  image 

1.  Laser  safety  concerns 

Eddy  Current 

1 .  Surface  defects 

E  Relatively  low-cost 

2.  Can  be  automated 

1 .  Limited  to  good  electrical 
conductors 

Edge  Replication 

1.  Surface  defects 

2.  Initiation  and 
progression  of  cracks 

1.  Ply-by-ply  record 

2.  Saturation  number  of 
transverse  cracks 

3.  Simple,  rapid 

4.  Permanent  record 

L  Surface  defects  only 

2.  Often  limited  to  coupon- 
type  specimens 

Table  5  Capabilities  of  NDI  Methods  for  Composites  (Ref  12) 


NDI  Method 

Core 

Damage 

Delami¬ 

nation 

Fiber 

Break 

Fiber 

Misalign¬ 

ment 

Impact 

Damage 

Inclusion 

Resin 

Variation 

Void 

Visual 

S 

S 

S 

S 

S 

S 

S 

A 

c 

C 

c 

B 

B 

A 

A 

A 

|  Ultrasonic 

B 

A 

A 

B 

B 

A 

A 

A 

A 

B 

A 

A 

H 

B 

A 

A 

A 

H 

C 

B 

B 

B 

C 

C 

B 

Acoustic 

Emission 

A 

m 

A 

A 

A 

A 

B 

A 

B 

A 

Shearo- 

graphic 

A 

A 

A 

B 

A 

C 

B 

B 

B 

A 

B 

B 

B 

Legend  -  A:  Good  detection  B:  Mav  not  detect  minor  damaee 

C:  Detection  when  defect  is  large  S:  Detection  at  surface  or  edge 

Notes:  a:  F°r  good  electrical  conductors 

Table  6  Typical  Acceptance  Criteria  For  Laminated  Composite  Structures  (Ref  12) 


No. 

Discrepancy 

Acceptance  Limit*  (in.) 

Repairable  Limit*  (in.) 

Repair  Procedure6 

1 

Surface 

Depressions 

0.25  dia.,  0.03  deep  or  less 
than  25%  of  laminate 
thickness. 

>0.25  dia,  <0.05  deep 
and  no  fiber  damage. 

Sand,  clean,  fill  with  epoxy,  cure,  sand  to 
dimensions  and  verify. 

2 

Surface  Pin  Holes 

0.10  dia.  or  0.03  dia.  holes 
over  10%  of  laminate  area. 

<0.25  dia.  or  >0.03  dia. 
covering  70%  of 
laminate  area. 

Sand,  clean,  fill  with  epoxy,  cure,  sand  to 
dimensions  and  verify. 

KB 

Surface  Cracks 

None. 

Not  applicable. 

Not  applicable. 

■ 

0.03  thick. 

None. 

Sand  (avoid  fiber  damage),  clean,  verify 
dimensions. 

LL 

Resin-Starved 

All,  if  only  on  surface  ply. 

None. 

Sand  (avoid  fiber  damage),  clean,  brush 
epoxy,  cure,  sand  to  dimensions,  verify. 

0.13  at  machined  edge. 

Trim,  apply  adhesive,  cure,  sand  to 
dimension,  verify. 

7 

Surface 

Inclusions 

0.10  sq.in.  each  with  5%  of 
laminate  area. 

Greater  than  acceptable 
limit. 

Sand,  clean,  fill  with  epoxy,  cure,  sand  to 
dimension,  verify. 

8 

Warps 

0.01  gap  from  flat  surface 
with  10  LB  applied  every 

12  inches. 

None. 

Not  Applicable. 

0.125  sq.in.,  and  away 
from  other  indications  ■ 

(Dimension  varies  with 
distance  from  edge.) 

Drill  0.0625  or  smaller  holes,  inject 
epoxy,  clean,  cure,  sand  to  dimension, 
verify. 

3%  - 10%  depends  on  class 
of  structure  ■ 

None. 

Not  applicable. 

Notes:  The  limits  shown  vary  with  manufacturers  and  can  be  overridden  by  specifications  on  engineering  drawings. 

b  ~  ^ 

The  repairs  are  conducted  to  process  specifications.  Only  the  outlines  are  presented  here. 

C 

Several  limits  might  be  included  to  reflect  importance  of  structure  (primary,  secondary,  redundant,  etc.)  or  NDI 
method  used.  Limits  can  also  be  given  in  terms  of  attenuation  of  the  signal. 

The  limits  vary  with  the  importance  of  the  structure  and  the  requirements  of  the  certifying  agency.  Specific 
_ limitsarejrftenjstate^ 
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Table  7  Typical  Acceptance  Criteria  for  Honeycomb  Sandwich  Composite  Structures  (Ref.  12) 


No. 

Discrepancy 

Acceptance  Limit"  (in.) 

Repairable  Limit" 

Repair  Procedure6 

1 

Core  Distortion 

Must  be  correctly  in  place  in 
lay-up  tool  when  tacked. 

Unlimited  for  Nomex 

cores 

None  for  fiberglass 
cores. 

Re-form  Nomex  cores  and 
assemble. 

Not  applicable  for 
fiberglass  cores. 

2 

Core  Crushing 

(Depends  on  location.  Usually) 

1  cell  deep,  1 .00  in  any 
direction. 

None. 

Remove  and  replace. 

3 

Core  Buckling 

1.00  in  any  direction  and  1% 
buckled  of  total  depth,  with 
next  buckled  area  at  least  6.00 
away. 

None. 

Remove  and  replace. 

4 

Core  Nesting 

(Number  of  cell  rows  depend 
on  particular  location.) 

None. 

Remove  and  replace. 

5 

Bond  Line  Thickness 

1  layer:  0.003  to  0.015 

2  layers:  max.  0.020,  etc. 

None. 

Not  applicable. 

6 

De-bonds 

Must  be  continuous. 

Unlimited  only  where 
repairable;  otherwise 
none. 

Repair  where  possible; 
otherwise  cut  out,  replace, 
re -bond. 

7 

Foam  Adhesive 

Generally  a  gap  length  of  3-4 
cells  over  6.00;  but  depends  on 
particular  location. 

Unlimited  only  where 
repairable;  otherwise 
none. 

Repair  where  possible; 
otherwise  cut  out,  replace, 
re -bond. 

8 

Discontinuous  Bond  Line 
Transverse  to  Splice 

0. 1  visible  width. 

None. 

Not  applicable. 

9 

Foreign  Material  in  Bond 
Line 

None. 

None. 

Not  Applicable. 

Notes:  aThe  limits  shown  vary  with  manufacturers  and  can  be  overridden  by  specifications  on  engineering  drawings. 

b  The  repairs  are  conducted  to  process  specifications.  Only  the  outlines  are  presented  here. 

SUMMARY  AND  CONCLUSIONS 

The  helicopter  industry  has  been  aware  for  sometime  of 
the  importance  of  addressing  the  issues  of  aging  aircraft. 
The  methods  for  substantiating  the  structural  integrity  of 
components  leads  to  possible  approaches  for  addressing 
problems  of  aging  aircraft.  These  methodologies  for 
assuring  the  structural  integrity  of  structures  have  been 
discussed  in  detail.  With  the  multiplicity  of  materials, 
manufacturing  processes  and  operating  spectra,  the 
extended  safe-life  approach  appears  best  to  address 
issues  of  both  initial  qualification  and  aging  aircraft.  The 
extended  safe-life  approach  though  appropriate  for 
civilian  operations  is  not  fully  favored  by  the  military. 
The  military  prefers  the  safe-life  approach  for  logistical 
reasons  and  because  of  difficulties  in  using  NDI  methods 
under  operational  conditions. 

A  discussion  of  the  available  NDI  methods  has  been 
provided  in  terms  of  acceptance  criteria  to  help  identify 
problems  associated  with  NDI  and  to  provide  directions 
for  alleviating  the  difficulties  encountered  by  the 
military.  The  severe  conditions  under  which  the  U.S. 
Navy  has  to  operate  is  shown  in  Fig.  12,  and  some  times 
under  these  conditions,  damage  tolerance  evaluations  are 
conducted  by  seamen,  the  average  age  of  whom  in  the 


current  U.S.  Navy  is  19  years,  Ref.  2.  Similarly,  the 
evaluations  by  the  foot  soldier  in  the  U.S.  Army  may  be 
conducted  under  less  than  optimum,  though  a  different 
set  of  difficult,  conditions. 

The  large  number  of  accidents  caused  by  operational  and 
environmental  conditions  beg  further  attention  because 
these  exceed  accidents  due  to  structural  failures  by 
several  magnitudes.  To  reduce  these  accidents,  further 


Fig.  12  Operating  conditions  of  the  U.S.  Navy  (Ref.  3) 
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development  of  all-weather  helicopters  are  required,  so 
that  helicopters  are  equipped  with  such  features  as  fly¬ 
by-wire  and  health  and  usage  monitoring  systems. 

The  technology  for  analysis  exists  today  to  assure 
structural  integrity  issues  of  aging  helicopters.  The 
extended  safe-life  approach  encompasses  the  best  of 
several  methodologies  to  make  the  qualification  of 
structural  integrity  affordable.  In  conjunction  with 
qualification  assurance,  the  development  and  validation 
of  simple-to-use  health,  structural  and  usage  monitoring 
systems  will  further  improve  the  integrity  of  structures  to 
meet  the  increasingly  stringent  requirements  of  both  the 
civilian  and  military  operators,  and  will  also  reduce 
accidents  due  to  non -structural  causes. 

Another  aspect  that  has  been  highlighted  is  the  need  for  a 
database  which  should  be  a  systematic  record  of  the 
failures  experienced  and  of  inspection  results  of  the 
causes  of  degradation  and  failures.  This  database  will 
provide  validation  that  manufacturers  require  for  further 
improving  the  structural  integrity  and  for  providing 
optimum  guidance  to  helicopter  operators.  With 
innovative  designs,  advanced  manufacturing  processes, 
improved  NDI  techniques  and  a  systematic  database  on 
experiences  encountered,  quality  assurance  for 
helicopters  can  eliminate  structural  failures  in 
worldwide,  all-missions  operations. 
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Abstract 

Restrictions  on  nations  military  budgets  require 
that  Air  Forces  will  operate  high  sophisticated  weapon 
systems  such  as  military  aircraft  far  beyond  their 
original  designed  life.  Modernization,  life  extension 
and  aging  aircraft  programs  are  defined  to  ensure  that 
future  mission  requirements  can  be  fulfilled  and  the 
airworthiness  of  the  aircraft  is  maintained  until  the  out 
of  service  date. 

Whilst  the  operational  life  is  increasing,  various 
aging  effects  take  place  and  impair  the  structural  and 
functional  integrity  of  high  aged  aircraft  subsystems 
even  before  their  design  life  are  reached.  An  integrated 
process  was  defined  between  customer  and  industry 
with  the  aim  of  extending  the  operational  life  of  the 
aircraft  under  limited  budgetary  conditions  and  tight 
timescales. 

Under  the  scope  of  this  task,  aging  of  equipment 
and  components,  the  impact  of  aging  problems  on 
structural  and  functional  integrity,  the  impact  of 
customer  extended  operational  requirements  on 
equipment  limitations  and  the  consequences  of  age 
related  failures  on  flight  safety  have  been  assessed. 

Recommendations  for  revised  maintenance  and 
inspection  programs  and  revised  limitations  have  been 
or  will  be  worked  out  by  industry  for  safety  and  non¬ 
safety  relevant  equipment  to  enable  formal  certification 
of  the  aircraft  for  the  extended  period. 

This  work  is  generally  accompanied  by 
equipment  design  review,  review  of  the  in-service 
usage,  investigation  of  reported  in-service  problems 
and  related  statistics,  master  inspections  of  subsystems 
in  high  aged  aircraft  and  investigation  of  aged  loan 
equipment,  provided  by  the  Air  Forces.  Additionally, 
programs  are  conducted  to  establish  revised  in-service 
operational  conditions. 

Various  programs  have  been  defined  by  the  FAA 
and  US  Air  Force,  which  aim  on  addressing  safety 
issues  in  aging  aircraft  structural  and  non-structural 
systems. 

For  the  20  years  old  Tornado  aircraft,  a  life 
extension  program  for  structure,  subsystems  and  engine 
is  presently  being  carried  out,  whose  results  should 
enable  certification  of  the  aircraft  for  the  extended 


operational  phase  and  support  safe  operation  of  the 
aircraft  for  the  next  25  years  which  means  a  life 
extension  by  roughly  one  aircraft  life. 

This  paper  discusses  the  various  aspects  related  to 
aging  of  subsystems  and  the  content  and  philosophy  of 
the  Tornado  equipment  life  extension  program. 
Furthermore  specific  problems  identified  in  various 
subsystems  are  presented  together  with  a  description  of 
the  way  ahead  for  life  extension. 

Overview 

This  lecture  comprises  of  four  major  parts: 

Part  1:  Introduction  and  a  general  review  of  the  aging 
system  problematic  and  other  problem  areas 
related  to  an  aged  aircraft 

Part  2:  A  description  of  the  subsystem  life  extension 
program  for  the  Tornado  IDS  variant 

Part  3:  Subsystem  Life  extension  approach  and 
experiences 

Part  4:  Conclusion 

Part  1 

Review  of  the  aging  system 
problematic  and  other  areas  of 
concern 

Introduction 

When  aircraft  are  getting  older  operators  are 
increasingly  confronted  with  problems,  which  are 
caused  by  the  aging  process  to  which  the  aircraft  are 
exposed.  Aging  could  degrade  the  integrity  of 
structures,  equipment  and  other  components  to  such  an 
extend  that  the  consequences  of  failures  could  be 
catastrophic. 

In  the  civil  aviation  very  spectacular  accidents 
occurred  where  aging  was  or  probably  was  the 
dominating  factor  through  which  the  accident  was 
caused: 
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the  Aloha  Airlines  737  accident  where  due  to 
hidden  corrosion  in  the  lap  splices  the  aircraft  lost 
a  big  portion  of  the  upper  front  fuselage  during 
flight 

the  TWA  Flight  800  in  July  1996,  where  the 
explosion  of  the  center  fuel  tank  might  be  caused 
by  wiring  problems. 

Both  accidents  revealed  that 

existing  maintenance  procedures  are  not 
adequately  addressing  aging  problems  in  areas, 
which  are  inaccessible  for  visual  inspections 

the  effects  of  aging  on  structural  and  functional 
integrity  of  aircraft  subsystem  components  and 
flight  safety  could  be  catastrophic 

To  operate  flight  systems  safely  within  their 
certified  life,  maintenance  procedures  have  been 
defined  taking  into  account  their  fail-safe  design 
philosophy.  This  means  that  any  failure  within  the 
subsystem,  which  could  lead  to  a  safety  critical  hazard, 
would  be  extremely  improbable  and  fly  to  failure  is  the 
prevailing  philosophy.  This  is  a  major  reason  why  the 
On-condition  Maintenance  Concept  (OCM)  is  applied 
to  the  majority  of  subsystem  components. 

As  aircraft  age,  the  number  of  failures  due  to 
aging  in  functional  equipment  or  other  system 
components  increases.  Aircraft  availability  and  mission 
success  will  be  increasingly  impaired  due  to 
unscheduled  maintenance  actions  required. 

Under  the  view  of  declining  budgets  and  the 
necessity  to  operate  aircraft  beyond  their  design  life 
investigations  are  performed  in  order  to  review  the 
aging  process  of  subsystem  components  in  aging 
aircraft. 

But  it  is  important  to  recognize,  that  the  aging 
process  of  any  component  cannot  be  prevented  but  the 
velocity  of  aging  can  significantly  be  reduced  by  e.g. 

identifying  critical  areas  and  components  where 
aging  could  have  serious  consequences 

reviewing  the  current  aging  process  of  subsystem 
components  in  high  aged  aircraft  or  of  high  aged 
components 

reviewing  the  current  maintenance  procedures  and 
policy  regarding  the  aging  problematic 

improving  preventive  maintenance  actions  in  order 
to  address  aging  in  an  early  stage. 

Fig.  1  presents  the  current  age  of  the  Tornado 
IDS  fleet.  It  indicates  that  the  oldest  Tornado  aircraft 
have  already  reached  a  service  life  of  20  years. 

Considering  a  further  planned  usage  beyond  the 
year  2020  for  the  IDS  variant,  some  IDS  aircraft  will 
stay  in  service  for  nearly  50  years. 
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Years  in  service 


Fig.  1:  Age  of  the  Tornado  IDS  fleet 

This,  however,  does  not  mean  that  the 
equipments  and  components  of  subsystems  will  remain 
in  service  such  a  long  time:  it  is  very  probable  that 
many  equipment  and  components  of  systems  have 
usually  already  been  replaced  during  regular  or 
unscheduled  maintenance  by  overhauled,  repaired  or 
new  items.  A  uniform  in-service  life  for  all  subsystem 
components  in  an  aged  aircraft  does  not  exist. 

It  is  therefore  important  for  critical  equipment  to 
record  in-service  operational  and  maintenance  data  in 
order  to  be  able  to  assess  the  usage  history  and  life 
consumption  and  define  the  point  of  retirement  or 
where  maintenance  actions  or  overhaul  is  required  to 
ensure  safe  operation.. 

Certification  rules  require  replacement  of 
equipment  when  its  certified  life  is  reached.  As  system 
components  have  often  a  life  potential  which  is  bigger 
than  the  certified  life  and  in  order  to  get  the  maximum 
benefit  of  equipment  in  terms  of  performance  and 
costs,  an  subsystem  life  extension  program  is  carried 
out. 

Within  this  life  extension  process,  which  will  be 
described  in  a  later  chapter,  aging  problems  within 
each  subsystem  have  been  investigated  and  taken  into 
account  for  defining  appropriate  measures  for  life 
extension. 

The  following  chapter  discusses  briefly  which 
effects  are  generally  contributing  to  aging  of  subsystem 
components. 

Aging  mechanisms 

Aging  is  understood  as  a  process,  where  the 
structural  and/or  functional  integrity  of  equipment  / 
components  will  be  continuously  degraded  by  the 
exposure  to  environmental  conditions,  under  which  the 
equipment  is  operated. 

This  could  lead  in  the  worst  case  to  a  situation 
where  the  aged  equipment  /  component  cannot  fulfill 
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any  more  its  designed  function,  even  before  the  design 
life  of  the  item  is  reached.  In  this  case,  subsystem 
functions,  which  the  item  has  fulfilled  or  supported, 
could  be  lost  or  degraded,  which  may  also  affect  flight 
safety. 

There  are  various  mechanisms,  which  alone  or  in 
combination  are  responsible  for  equipment  aging. 

-  Exposure  to  normal  or  salty  atmosphere,  heat, 
water,  oil,  grease,  fuel,  ultraviolet  light,  etc.,  which 
could  lead  to  corrosion,  embrittlement,  swelling, 
overheating,  melting  or  other  material  degradation, 
electrical  interruptions,  short  circuits,  etc. 

Exposure  to  vibration  and  acoustic  environment, 
which  could  lead  to  fatigue  damages,  wear  and 
tear,  etc. 

Endurance,  which  could  lead  to  leakage,  wear  and 
tear,  etc. 

Storage,  which  means  exposure  to  storage 
conditions,  specified  by  the  equipment  supplier  or 
in-service  practice 

Maintenance  activities,  which  can  induce 
accidental  damages  (which  could  be  a  particular 
problem  for  wiring) 

It  is  likely  that  reliability  and  availability  of 
equipment  will  be  impaired  by  these  mechanisms. 

Additionally,  incorrect  installation  of  equipment 
could  also  have  a  detrimental  effect  and  support  the 
aging  process,  e.g.  enable  chafing  of  wire  bundles  on 
surrounding  structure  (this  can  be  the  result  of  poor 
design  but  also  of  poor  maintenance). 

Aged  equipment  and  components  will  be  removed 
from  service  if  further  use  is  not  recommended  for 
safety  reasons  or  if  further  safe  operation  is 
uneconomical  due  to  required  inspection  and 
maintenance  activities. 

Life  expired  equipment  can  be  defined  by  the  fact 
that  any  in  (equipment)  specification  specified  and 
certified  life  limitations  are  reached  by  the  in-service 
usage  and  therefore  need  to  be  replaced. 

Life  extension  might  be  possible  and  needs  to  be 
investigated.  In  case,  the  design  and  certification 
authority  permit  further  on  aircraft  operation  under 
clearly  defined  conditions,  further  use  of  the  equipment 
can  be  tolerated  without  formal  re-qualification  and  for 
a  limited  time:  as  the  aircraft  runs  out  of  certification 
(>4000  FH)  and  the  formal  certification  process  up  to 
8000  FH  has  not  been  completed  yet,  the  definition  of 
such  conditions  and  requirements  for  further  usage  up 
to  5000  FH  is  part  of  the  Tornado  life  extension 
program. 


Influence  of  maintenance  on  aging 

As  already  mentioned,  aging  of  equipment  and 
components  cannot  be  prevented  but  slowed  down.  It  is 
reasonable  to  say  that  if  maintenance  is  poorly  or  not 
timely  conducted  certain  aging  effects  (e.g.  wear  and 
tear,  contamination,  corrosion,  etc.)  could  be 
accelerated  or  even  started. 

This  means  that  the  physical  condition  of  aged 
equipment  and  components  in  different  aircraft  can 
vary  due  to  different  quality  of  maintenance  carried  out 
which  could  result  in  earlier  retirement  of  components 
than  assigned. 

Aircraft  maintenance  programs  will  always  be  a 
compromise  as  beside  others  logistic  costs  and  overall 
fleet  management  are  important  issues,  which  drive 
their  definition. 

The  Tornado  is  operated  by  three  different  air 
forces,  which  have  different  maintenance  programs  and 
procedures.  The  major  depot  inspection  for  the  RAF 
and  GAF  is  currently  at  2400  FH  (or  14  years,  RAF 
only)  and  2000  FH  for  the  IAF.  Considering  the  fact 
that  at  the  beginning  of  the  Tornado  program  the  DI 
was  at  1600  FH,  the  time  where  a  thorough 
investigation  of  the  aircraft  condition  is  performed  has 
significantly  increased  (by  50%). 

In  view  of  this  and  to  address  aging  problems,  it 
is  important  to  include  preventive  maintenance  actions 
for  critical  equipment  and  areas,  at  shorter  intervals  in 
periodic  servicing  schedules  or  in  special  inspections, 
to  ensure  that  aging  problems  will  be  detected  in  an 
early  state  where  the  effort  for  repair  is  still  acceptable 
and  an  airworthiness  critical  situation  far  away. 

Within  the  Tornado  subsystem  life  extension 
program  aging  effects  on  equipment  and  components 
are  investigated  as  far  as  they  are  obvious  and  known. 
The  results  of  these  investigations  will  be  used  by  the 
manufacturers  to  establish  revised  maintenance 
procedures  for  their  equipment  where  necessary. 

Other  problems  areas 

Besides  the  aging  problematic,  other  topics  which 
are  not  related  to  aging  but  causes  problems  in  an  aged 
aircraft  need  to  be  considered  and  investigated.  The  list 
might  not  be  complete  but  describe  the  major  problem 
areas. 

Operational  conditions 

These  might  have  changed  during  the 
lifetime  of  the  aircraft. 

For  an  aged  aircraft  where  life  extension  is 
an  issue  the  current  and  future  planned  operational 
conditions  need  to  be  investigated  and  compared  to 
the  original  design  requirements.  This  can  be  done 
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by  engineering  assessments  or  if  the  conditions 
cannot  be  established  on  an  theoretical  basis  by 
Operational  Load  Measurement  (OLM)  programs. 

The  outcome  of  such  programs  will  be  used 
to  calculate  existing  clearances  and  life  potential  or 
provide  a  basis  for  further  qualification  testing. 

The  establishment  and  conduction  of  OLM 
programs  are  often  very  costly  and  time 
consuming.  Therefore,  any  decision  for  such 
programs  should  be  taken  early  enough  to  ensure 
that  results  are  available  in  time. 

In  the  Tornado  program  such  Operational 
Load  Measurements  (OLM)  are  conducted  in  the 
Landing  Gear  System  as  presented  later. 

Usage  history,  life  consumption 

As  required  by  formal  certification  rules, 
equipment,  which  exceeds  stated  life  limits  are 
formally  out  of  certification.  Therefore,  the  usage 
history  needs  to  be  established  and  this  requires 
the  availability  of  complete  in-service 
documentation  (LOG  cards,  maintenance 
documentation). 

Unfortunately,  it  has  been  experienced  that  it 
is  sometimes  very  difficult  to  get  all  the 
information  necessary  to  assess  service  life  and  life 
consumption.  For  safety  relevant  and  life  limited 
components  this  causes  many  problems  as  it  might 
be  not  possible  in  these  cases  to  establish  whether 
an  equipment  is  already  life  expired  or  not. 

Repairs  and  concessions 

The  influence  of  repairs  and  concessions  on 
life  limitations  needs  to  be  assessed. 

Normally,  minor  concessions  should  not 
affect  life  limits,  but  if  the  operational  conditions 
have  changed  in  the  past,  the  classification  of 
concessions  needs  to  be  reassessed. 

Obsolescence 

Obsolescence  is  a  problem,  which  becomes 
more  problematic  with  increasing  age  of  the 
aircraft. 

Materials  and  components,  which  have  been 
used  in  the  original  design,  could  be  no  more 
available  and  this  could  require  redesign  and  re- 
qualification  activities  if  no  proofed  and  certified 
alternatives  exist. 

Especially  for  electronic  parts  obsolescence 
is  a  critical  and  costly  issue  as  technology  progress 
over  the  last  20  years  was  so  enormous  that  certain 
items  remain  only  available  in  a  limited  quantity. 
A  strategy  for  future  support  of  electronic 
equipment  needs  to  be  established. 


Availability  of  original  supplier 

For  most  of  the  major  equipment  there  was 
only  one  supplier  selected,  who  has  designed  and 
qualified  the  item.  This  supplier  might  have 
disappeared  or  no  more  able  to  produce  the 
required  component.  Introduction  of  alternative 
supplier  will  cause  problems  in  terms  of  time  and 
costs.  Dependency  on  one  supplier  is  critical  but 
usual. 


Costs  for  procurement  of  equipment 

The  procurement  of  equipment  for  replacing 
aged  or  life  expired  equipment  after  20  years  in 
service  could  be  very  costly  as  e.g.  original 
supplier  are  no  more  existent,  design  and 
qualification  of  new  components  are  necessary  or 
the  required  number  of  equipment  is  very  small. 

Inspections  and  inspection  efficiency 

With  the  aging  of  the  aircraft  aging  effects 
will  increasingly  require  inspections  of  critical 
equipment  and  components  to  ensure  that  any 
aging  effect  will  not  lead  into  a  safety  hazardous 
situation.  The  success  of  inspections  is  very 
dependent  on  the  selection  of  the  appropriate 
methods,  availability  of  required  equipment, 
clearly  defined  inspection  procedures,  availability 
of  trained  personal. 

Maintenance  documentation 

Existing  maintenance  procedures,  which  do 
not  address  aging  as  experienced  by  investigations 
or  sampling,  needs  to  be  revised.  Requirements  or 
recommendations  of  the  equipment  manufacturer, 
defined  during  the  life  extension  process,  should 
be  included. 

Failure  and  maintenance  reporting  systems 

Most  aircraft  users  are  maintaining 
comprehensive  databases  to  collect  and  evaluate 
failure  and  maintenance  reports  for  the  whole 
aircraft  down  to  equipment  and  component  level  in 
order  to  identify  unreliable  equipment  and  other 
problem  areas. 

However,  in  service  data  collection  systems 
are  mainly  defined  by  the  aircraft  users  and  reflect 
their  specific  needs  and  points  of  interest.  The 
definition  of  data  elements  and  the  level  of  detail 
may  significantly  vary,  even  between  the  different 
users  of  the  same  aircraft  type. 

For  this  reason,  the  probability,  that  failure 
and  maintenance  data  collected  during  service  are 
compatible  with  design  analysis  and  predictions  is 
fairly  low. 
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Moreover,  in  service  data  are  not  always 
available  to  the  system  design  authority  at  a  level 
required  e.g.  for  equipment  aging  investigations. 

The  value  of  an  in  service  database  can  only 
be  as  good  as  the  entries.  It  is  therefore  important 
to  consider  that  any  analysis  or  curves  derived 
from  databases  need  specific  interpretation  and 
should  be  taken  with  care. 

The  major  “lessons  learnt”  for  future  data 
collection  systems  are  therefore  continuous 
availability  to  both  user  and  manufacturer  and  the 
need  for  compatibility  with  design  analyses,  in 
order  to  gain  maximum  benefit  over  the  aircraft 
lifetime. 

Similar  problems  are  mentioned  in  other 
publications.  It  is  therefore  important  to  consider 
that  any  analysis  or  curves  derived  from  databases 
should  be  taken  with  care. 

Aging  of  Tornado  subsystems 

To  get  an  overview  on  the  magnitude  of 
subsystem  aging  problems,  the  increase  of  aging 
related  failure  rates  have  been  investigated.  Fig.  2. 


Increase  of  Subsystem  failure  rate  (/1000FH)  for  1990  - 1999 


Fig.  2:  Reported  in-service  failures  due  to  aging 

For  these  trend  curves  failures  are  considered 
which  could  be  attributed  to  aging,  such  as  corrosion, 
wear  and  tear,  leakage,  contamination,  porosity, 
brittleness,  contact  damage,  isolation  damage,  etc. 

However,  it  should  be  noted  that  these  curves  are 
only  trend  curves  as  it  is  very  difficult  to  analyze 
whether  the  reported  failures  are  really  due  to  aging  or 
other  influences. 

The  analysis  has  been  performed  for  the 
following  subsystems  and  for  the  period  1990  until 
1999: 

Landing  Gear  subsystem 


Flight  Control  subsystem 
Electric  Subsystem 
ECS  Subsystem 
Fuel  Subsystem 
Hydraulic  Subsystem 

The  investigation  show  an  significant  increase  of 
aging  related  failures  over  the  last  decade  for  the 

Hydraulic  Subsystem  by  160% 

Fuel  Subsystem  by  120% 

Landing  Gear,  Flight  Control  and  ECS  subsystem 
by  50% 

Electric  Subsystem  by  15%. 

The  biggest  contribution  to  the  above  curves  in 
the  Hydraulic  and  Fuel  System  is  leakage  with  43%, 
respectively  19%. 

After  the  description  of  general  aspects  of  the 
aging  problematic  and  additional  problem  areas,  we 
have  encountered  in  the  Tornado  program,  part  2  will 
describe  the  Tornado  Subsystem  Life  Extension 
program  for  the  Tornado  IDS  variant,  as  it  is  presently 
being  carried  out. 

Part  2 

Tornado  subsystem  life  extension 
program 

As  introduction  a  very  brief  survey  of  the 
Tornado  program  should  be  given,  before  describing  in 
detail  the  philosophy  and  process  of  the  Tornado 
Subsystem  Life  Extension  program. 


Tornado  Program 


The  Tornado  aircraft  was  designed  and  developed 
in  three  European  countries,  the  United  Kingdom 
(42,5%  share),  Germany  (42,5%)  and  Italy  (15%) 
according  a  set  of  tri-national  agreed  Performance  and 
Design  Requirements  (PDR)  which  form  a  compromise 
between  national  requirements. 
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The  major  aerospace  companies  in  these  three 
countries  were  in  charge  to  build  this  aircraft,  which 
have  been  British  Aerospace,  BAe,  (now  BAE 
SYSTEMS),  Messerschmitt-Bolkow-Blohm,  MBB, 
(now  DaimlerChrysler  Aerospace,  DASA)  and 
Aeritalia  (now  Alenia). 

The  PANAVIA  Aircraft  GmbH  was  formed  by 
these  three  companies  (PANAVIA  Partner  Companies, 
PPCs)  in  order  to  manage  the  program  on  industry  side. 

On  the  customer  side,  the  program  is  controlled 
by  NAMMO,  the  NATO  MRCA  Development  and 
Production  Management  Organization,  and  today 
managed  by  the  NATO  European  EF2000  and  Tornado 
Agency,  NETMA  (former  NAMMA).  NAMMO  and 
NETMA  are  staffed  by  specialists  from  all  three 
Nations. 

The  first  flight  of  Tornado  was  successfully 
performed  in  1974  and  the  first  production  aircraft  was 
completed  in  1980. 

In  total  977  aircraft  have  been  built  in  two  major 
variants,  that  are  the 

Interdiction  Strike/ Attack  (IDS)  variant,  which  is 
operated  by  all  three  Nations  Air  Forces  (RAF: 
228  aircraft,  GAF:  357,  IAF:  99)  and  also  the 
Royal  Saudi  Air  Force  (RS  AF)  (96) 

and  the 

Air  Defense  Version  (ADV),  which  is  operated  by 
the  RAF  (173)  and  the  RSAF  (24).  Today  also  the 
IAF  operate  ADV  aircraft,  leased  from  the  RAF. 

Single  stick  and  trainer  versions  exist  for  both 
variants.  Additional,  for  the  IDS  various  sub-variants, 
e.g.  the  Electronic  Combat  Reconnaissance  (ECR) 
variant,  exist,  differently  equipped  to  perform  specific 
missions  and  to  carry  specific  external  stores. 

The  development  and  production  of  Tornado  was 
shared  between  the  three  Nations  roughly  according  the 
intended  number  of  aircraft  they  wished  to  procure. 

The  responsibilities  for  design  and  production  of 
the  airframe  were  shared  between  BAE  SYSTEMS 
(front  and  rear  fuselage),  DASA  (center  fuselage)  and 
Alenia  (wing). 

For  the  development  and  qualification  of 
subsystems.  System  Design  Responsibilities  (SDR)  for 
each  system  and  Equipment  Design  Responsiblies 
(EDR)  were  defined.  SDRs  and  EDRs  were  shared 
between  BAE  SYSTEMS  and  DASA  but  they  were  not 
necessarily  in  one  hand. 

As  there  are  some  differences  in  subsystem 
design  between  IDS  and  ADV,  a  separate  life  extension 
task  has  been  defined  for  the  ADV  variant.  This  task 
deals  with  the  life  extension  of  ADV  specific 
equipment  and  equipment,  which  is  common  to  IDS 
but  differentially  loaded  in  service  and  therefore 
different  life  limitations  needs  to  be  established. 


Common  items  to  IDS  with  same  operational  loading 
conditions  are  covered  by  the  IDS  life  extension 
process. 

In  this  lecture,  only  the  IDS  life  extension  process 
will  be  described  where  the  fundamentals  of  this 
process  have  been  discussed  and  defined. 

Tornado  IDS  Subsystem  Life  Extension 
Process 

The  subsystem  life  extension  program  is  integral 
part  of  the  aircraft  life  extension  program,  which 
includes  also  engines  and  structures.  Aircraft 
certification  will  be  a  compilation  of  the  output  of  all 
three  separate  tasks. 

Nations  requirements  for  the  extended  use  of 
Tornado  IDS  are  shown  in  Fig.  3. 

The  basic  tri-national  requirement  for  life 
extension  was  that  PANAVIA  should  establish  the 
basis  for  aircraft  certification  up  to  8000  FH,  based  on 
the  original  PDR  requirements. 

Additional  to  that,  UK  wish  to  extend  the  life  of 
their  IDS  for  a  further  2000  FH  up  to  10000  FH. 


Current  and  future  Nations  IDS  Life 
Requirements 


(GE  and  IT)  (UK) 


Fig.  3:  Life  extension  requirements 

The  current  planning  of  Nations  air  forces 
revealed  that  they  intend  to  operate  the  IDS  Tornado 
aircraft  beyond  the  year  2025  (GE  and  IT)  and  2020 
(UK),  which  means  that  the  oldest  aircraft  will  stay  in 
service  for  about  50  years. 

Certification  documentation  of  the  aircraft  and  its 
equipment  includes  life  limitations.  Consequently, 
operational  use  by  the  air  forces  beyond  this  limitation 
is  at  Air  Forces  own  risk  and  absolves  PANAVIA  and 
their  supplier  from  any  product  liability. 

Therefore,  Nations  via  NETMA  required  that 
PANAVIA  should  be  tasked  to  perform  work  that 
would  allow  PANAVIA  to  resume  the  product  liability 
for  the  extended  period. 
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In  1995  PANAVIA  was  contracted  to  carry  out  a 
program,  which  aims  on  extending  the  life  of 
TORNADO  IDS  and  ECR  variants  significantly 
beyond  the  current  life  limits  up  to  8000  FH,  which 
means  a  doubling  of  the  aircraft  operational  life. 

The  overriding  constraint  upon  extended 
certification  is  that  no  significant  reduction  of  flight 
safety  is  acceptable,  although  equipment  reliability  in 
some  cases  may  be  degraded  with  time.  This  requires 
the  identification  and  assessment  of  equipment  and 
components  which  failure  would  be  safety  critical. 

The  certification  of  equipment  for  the  extended 
period  requires  that  the  equipment  Declaration  of 
Design  &  Performance  (DDP)  will  have  to  be  updated 
stating  the  new  life  limits  as  outcome  from  the  life 
extension  process. 

The  approach  of  identifying  equipment,  which 
should  be  regarded  for  life  extension  activities, 
considers  that  aircraft  subsystems  are  generally 
designed  to  fail  safe  design  principles  and  thus 
comprise  of  equipment  and  components  which  can  fail 
to  perform  their  function  without  presenting  or 
significantly  contributing  to  a  hazardous  situation. 

The  philosophy  of  this  approach  was  agreed  with 
NETMA  and  PANAVIA  was  tasked  to  focus  on  safety 
relevant  items  which  definition  for  the  purpose  of  this 
task  has  been  defined  as  follows: 

Components  are  considered  to  be  safety 
relevant ,  where  a  single  failure  would  cause  a 
hazard  or  which  in  combination  with  other 
failures  would  significantly  contribute  to  a 
hazardous  situation. 

A  hazardous  situation  occurs  when  conditions  arise 
which  threaten  the  safety  of  the  crew,  aircraft, 
ground  crew  or  third  parties. 

For  this  life  extension  task  the  term  safety 
relevant  covers  both  “Flight  Safety  Critical”  and 
“Flight  Safety  Involved”  incidents. 

The  following  list  states  the  Tornado  flight 
systems,  which  are  subject  of  life  extension  activities: 

Crew  System 

Electric  System 

Environment  Control  System 

Fire  Detection  &  Suppression  System 

Flight  Instruments 

Flight  Guidance  &  Control  System 

Flight  Control  System 

Fuel  System 

Hydraulic  System 

Landing  Gear  System 

Pitot  Static  System 


Propulsion  System 
Secondary  Power  System 
Weapon  delivery  system 
UK  Armament  Control  System 

The  assessment  of  the  safety  relevance  of 
equipment  attachment  structures  was  also  part  of  the 
task.  Each  EDR  performed  the  assessment  of 
attachment  structures  for  his  area  of  responsibility  and 
defined  in  conjunction  with  the  relevant  structure  SDR 
appropriate  measures  for  life  extension,  if  necessary. 

For  financing  and  managing  purposes,  the  whole 
life  extension  task  was  structured  into  4  different 
phases,  in  which  the  level  of  involvement  of  the 
customer,  PANAVIA  and  the  PPCs  and  the  supplier 
varies  significantly. 

Phase  A:  Identification  of  Safety  Relevant  Equipment 
and  Attachment  structures 

Phase  B:  Nations  review  of  Phase  A  recommendations 
and  selection  of  items  which  should  be 
subject  of  further  life  extension  work 

Phase  C:  Equipment  extended  certification  activities 

Phase  D:  Aircraft  extended  certification  and 

preparation  of  a  new  PANAVIA  Lifed  Items 
List. 


It  is  currently  planned  to  finish  the  IDS 
subsystem  life  extension  program  at  the  end  of  2002 
including  UK  IDS  life  extension  to  10000  FH  and 
aircraft  certification  activities. 

Phase  A 

Identification  of  Safety  Relevant  Equipment 
and  Attachment  structures 

A  process  flow  diagram  for  Phase  A  and  B  is 
given  in  the  annex. 

For  each  system,  review  of  the  existing  System 
Safety  Assessments  Reports  was  the  agreed  approach  to 
determine  the  safety  or  non-safety  relevance  of 
equipment  according  to  their  contribution  to  a 
hazardous  situation. 

As  these  reports  have  been  issued  a  considerably 
time  ago  during  the  design  phase  of  Tornado,  new 
experiences  and  in-service  arisings  have  also  been 
taken  into  account  as  well  as  the  effects  of  equipment 
failure  on  surrounding  area  and  also  where  failure 
effects  cross  the  boundaries  of  different  subsystems. 

Completeness  was  ensured  by  use  of  equipment 
lists  (WUC)  and  illustrated  part  catalogues. 
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As  a  result  of  the  safety  assessments  during 
Phase  A,  a  Flight  System  Hazard  Analysis  Report  has 
been  produced  by  PANAVIA  covering  separately  each 
subsystem. 

For  each  safety  relevant  item  a  proforma  was 
written  by  the  Equipment  Design  Responsible  (EDR), 
which  provides  informations  of  the  equipment  as  for 
instance  part  number,  DDP,  qualification  status,  life 
limitations  and  overhaul  requirements,  its  function 
within  the  subsystem,  failure  mode  and  hazard 
contribution.  The  proforma  format  ensured  consistent 
information  for  all  equipment  and  components  for  all 
subsystems.  The  overall  responsibility  of  the  content  of 
the  proforma  rests  with  the  SDR  for  each  subsystem. 

This  report  also  provide  a  subsystem  equipment 
list  supporting  the  aircraft  level  certification  for  all 
items  which  are  no  more  further  considered  as  they  are 
of  negligible  or  low  risk. 

The  final  phase  A  report  was  subject  of  a  system 
review  meeting  attended  by  NETMA,  Nations  and 
PANAVIA  in  order  to  further  refine  the  safety 
relevance  of  equipment  into  one  of  the  subsets  of  safety 
relevance  as  described  below: 

CAT1:  Item  Safety  Relevant,  qualification  life 
limitations  are  critical  and  to  be  observed 

CAT2:  Item  Safety  Relevant  but  qualification  life 
limitations  are  unlikely  to  be  critical  and  further 
qualification  or  analysis  to  extend  life  should 
be  considered. 

CAT3:  Item  Safety  Relevant,  failure  or  malfunction  of 
the  item  has  no  significant  airworthiness 
consequences. 

The  general  guidelines  for  determination  of  the 
safety  relevance  are  presented  in  the  following  table. 


This  guideline  chart  cannot  be  regarded  as 
definitive.  It  essentially  required  system  specialist 
engineering  judgment  to  establish  the  severity  of  any 
failure  or  failure  combination  consequences. 

Additional,  the  following  criteria  have  been 
considered  in  the  categorization  refinement  review: 

Level  of  resulting  hazard 
Probability  of  occurrence 
Subsystem  design  philosophy 
Dormancy 

Prevailing  poor  reliability 

Fatigue,  endurance  or  any  other  life-limiting  factor 
Impact  on  existing  overhaul  or  maintenance 

All  components,  which  have  not  been  categorized 
in  one  of  the  above  categories,  have  been  defined  as 
Non  Safety  Relevant  (NSR). 

After  each  subsystem  review,  each  proforma 
were  reviewed  and  amended  to  include  statements 
declaring  the  agreed  safety  relevant  categorization 
together  with  the  justification  argument  or  evidence. 

It  was  agreed  at  the  end  of  this  phase  that 
equipment,  which  has  been  categorized  as  CAT3  or 
NSR,  could  be  regarded  as  suitable  for  continued 
service  in  accordance  with  an  On  Condition  lifing 
policy  (OCM),  which  means  a  concept  of  maintenance 
that  is  free  from  scheduled  actions.  Maintenance  action 
is  taken  only  when  an  item  of  equipment  is  found  to  be 
defective.  Exceptions  to  OCM  are  permitted  only  when 
a  scheduled  action  is  necessary  to  prevent  a  safety 
hazard,  inability  to  meet  safe  life  design  criteria,  or  on 
grounds  of  economy  to  preclude  expensive  damage. 

There  are  specific  items,  which  need  special 
consideration  in  terms  of  life  extension: 


Severity  of 
hazard 

Catastrophic 

Critical 

Marginal 

(Major) 

Negligible 

Single  failure 
Safety  critical 

CATl 

OR 

CAT2 

CATl 

OR 

CAT2 

Double  failure 
common  mode 
contribution 

CAT1 

OR 

CAT2 

CATl 

OR 

CAT2 

Not  Safety 
Relevant 

Not  Safety 
Relevant 

Double  Failure 
Dormant  Item 

CAT1 

OR 

CAT2 

CATl 

OR 

CAT2 

Not  Safety 
Relevant 

Not  Safety 
Relevant 

Double  Failure 
Significant 
contribution  / 
known  problem 

CAT1 

OR 

CAT2 

CATl 

OR 

CAT2 

Not  Safety 
Relevant 

Not  Safety 
Relevant 

Double  Failure 
Non-Do  rmant 
Item 

CAT3 

CAT3 

Not  Safety 
Relevant 

Not  Safety 
Relevant 

>  OR  =  Triple 

Failure 

condition 

CAT3 

CAT3 

Not  Safety 
Relevant 

Not  Safety 
Relevant 

Safety  relevant 

Non  Safety  Relevant 

PANAVIA  Standard  Items 

There  is  a  big  number  of  standard  parts  as 
connectors,  screws,  relays,  switches,  clamps  etc.  used 
all  over  the  aircraft  and  commonly  in  different 
subsystems. 

These  items  are  normally  not  limited  to  flying 
hours  but  are  specified  to  operations,  cycles  etc.  There 
are  also  numerous  items  for  which  no  life  limitations 
exist. 

The  general  approach  for  standard  items  is  to 
reduce  the  list  to  items  for  which  a  life  limitation  was 
stated  and  which  is  not  sufficient  in  view  of  the  lifing 
requirements  of  this  task.  Additionally,  items  are 
considered  which  contain  any  degradable  or  perishable 
materials. 

For  these  items  an  assessment  on  their  safety 
relevance  in  above  terms  has  been  conducted  and  a 
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categorization  defined.  This  approach  is  shown  in 
detail  in  a  flow  chart  in  the  annex. 

All  other  standard  items,  which  are  not  safety 
relevant,  are  considered  to  remain  on-condition. 

Electrical  Wiring 

Electrical  wiring  is  largely  used  in  the  aircraft.  It 
comprises  of  PANAVIA  wire  of  various  construction 
and  materials,  electrical  connectors,  loom  supporting 
devices  etc.  The  life  extension  strategy  for  wiring  is 
discussed  in  Part  3  of  this  paper. 

Attachment  structure  items 

The  system  engineers  have  reviewed  the 
criticality  of  attachment  structure  items.  It  became 
obvious  that  not  all  structure  items  need  specific 
actions  for  life  extension. 

Attachment  structure  items  are  generally 
designed  to  static  stress  conditions,  loads  resulting 
from  crash  and  maneuver  accelerations  and  stiffness 
requirements.  Additional,  the  installation  uses  good 
design  practices  related  to  bend  radii,  hole  edge 
distances  and  minimizing  tension  cleat  loading.  These 
criteria  result  in  equipment  supports,  which  are 
sufficiently  robust  for  any  normal  aircraft  lifing. 

It  is  further  considered  that  fatigue  is  not  a 
dominating  factor  for 

Large  bore  Pipes  in  the  air  and  Fuel  subsystem 

Small  bore  pipes  in  the  Hydraulic  and  Oxygen 

subsystem 

Flying  Control  Linkages 

Whilst  good  design  practices  were  used  in  order  to 
reduce  the  risk  of  failures,  in-service  maintenance 
programs  and  inspections  have  to  ensure  that  the 
integrity  of  such  components  due  to  corrosion, 
contamination,  foreign  damages  etc.  are  not  impaired. 

Attachment  structure  items,  which  fall  under  the 
above,  are  no  more  subject  to  fatigue  life  extension 
activities. 

All  other  components  and  specific  equipment 
mounting  structures  are  covered  by  the  structure  life 
extension  task. 

In  Phase  B  now,  the  results  of  Phase  A  activities, 
laid  down  in  the  System  Hazard  Analysis  Report 
formed  the  basis  for  the  customer  review  of  safety 
relevant  items. 


Phase  B 

Nations  review  of  Phase  A  recommendations 
and  selection  of  items  which  should  be  subject 
of  further  life  extension  work 

During  this  phase  NETMA  and  Nations  reviewed 
the  recommendations  provided  by  PANAVIA  within 
the  System  Hazard  Analysis  Report  with  their  own 
specialists  and  took  decisions  on  which  safety  relevant 
component  they  wish  to  support  for  extended 
certification. 

The  following  criteria  (beside  others)  might  have 
been  used  by  the  customer  for  their  decisions: 

Premature  failures  predominant  in-service,  i.e.  the 
item  does  not  generally  achieve  its  current  design 
life 

Financial  and  economic  aspects  as  life  extension 
will  be  too  expensive  or  too  long,  low  cost  item, 
economic  of  overhaul,  obsolescence  arisings 

Modification  is  already  planned  to  replace  existing 
item 

At  the  end  of  this  phase  the  customer  stated  to 
PANAVIA  which  equipment  should  be  subject  of 
further  life  extension  activities  in  Phase  C. 

Phase  C 

Equipment  extended  certification  activities 

A  process  flow  diagram  for  Phase  C  and  D  can  be 
found  in  the  annex. 

This  phase  consist  in  detail  of 

requesting  suppliers  proposal  for  life  extension  of 
safety  relevant  CAT2  equipment  which  have  been 
selected  with  a  declared  preferred  option  for  life 
extension 

assessment  of  suppliers  proposal  and  agreement  on 

a  technical  and  financial  issues 

issuing  the  proposal  to  the  customer  awaiting 

authorization  for  start  of  work 

conducting  of  life  extension  technical  work  based 

on  original  specification  requirements 

update  of  equipment  DDP  reflecting  the  latest 

qualification  status  and  finally 

update  of  the  System  Hazard  Analysis  Report  at 

conclusion  of  work  within  a  specific  subsystem 
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Phase  D 


The  answers  on  both  items  will  define  future 
usage  requirements. 


Aircraft  extended  certification  and  preparation 
of  a  new  PANAVIA  Lifed  Items  List. 

After  completion  of  the  equipment  extended 
qualification  activities,  this  Phase  D  covers  the  aircraft 
level  certification  activities. 

Also  within  this  phase,  a  new  PANAVIA  Lifed 
Items  List  will  be  issued,  containing 

lifing  requirements  for  all  safety  relevant  items, 
which  have  not  achieved  full  qualification 
evidence  (with  respect  to  the  LE  lifing 
requirements) 

mandatory  overhaul  requirements  for  the  extended 
period 

Part  3  will  now  describe  in  some  detail  for 
various  subsystems  the  agreed  specific  approach  for 
life  extension  and  major  findings  and  problem  areas 
related  to  aging  experienced  during  the  life  extension 
work. 

Part  3 

Subsystem  Life  extension 
approach  and  experiences 

Life  extension  measures 

Most  of  the  Tornado  equipment  were  only 
qualified  according  the  life  requirements  stated  in 
subsystem  and  equipment  specifications  and  only  some 
equipment  have  already  been  subject  to  extended 
qualification.  For  many  equipment,  where  no 
significant  failure  at  the  end  of  their  original 
qualification  was  found,  the  final  life  is  unknown. 

The  definition  of  the  appropriate  measure  for 
equipment  life  extension  was  made  in  cooperation  with 
the  equipment  supplier  taking  into  account  all 
information  available  from  original  qualification,  in- 
service  experience  and  future  service  requirements. 

In  principle  the  following  questions  must  be 
answered: 

a)  Is  the  presently  stated  clearance  still  valid  and  is 
there  any  life  potential  for  extended  use  beyond 
4000  FH  based  on  the  existing  or  changed  service 
requirements  or  under  which  conditions  is  the 
extended  use  acceptable? 

b)  Are  there  any  limiting  factors,  as  for  instance 
aging  problems,  low  reliability,  economical 
reasons,  which  would  not  recommend  further 
usage  of  the  item? 


Item  a)  will  generally  be  investigated  by 

review  of  the  original  qualification 

assessment  of  validity  of  original  specified 
operational  requirements,  e.g.  supported  by  OLM 
programs 

analysis 

conduction  of  re-qualification  programs  covering 
aspects  such  as  fatigue  and  endurance  testing 
(taking  into  account  revised  operational 
conditions,  where  agreed  with  the  customer) 

Item  b)  will  generally  be  investigated  by 

review  of  the  in-service  experience  (reported 
failures,  repair  and  overhaul  experience,  . . .) 

review  of  MTBF  data  where  available 

sampling  of  aged  equipment  from  service,  for 
which  a  full  service  history  can  be  provided, 
where  the  consumed  life  can  be  established,  which 
have  not  been  overhauled  and  where  the 
operational  usage  is  representative  for  the  normal 
fleet  usage 

Master  inspections  of  complete  subsystems,  which 
take  place  on  one  or  several  different  aircraft, 
which  have  a  service  life  near  to  4000  FH 

Zonal  inspections  of  critical  zones,  which  have 
been  defined  for  instance  by  the  results  of  the 
Master  Inspection  or  by  available  experience  from 
service 

Although  difficult  to  say  generally,  the  following 
table  tries  to  give  an  overview  on  the  measures  which 
are  conducted  for  a  certain  type  of  equipment  / 
component,  (however  this  does  not  mean  that  all 
measures  are  conducted  in  the  same  time) 


Equipment  / 
Component 

Life  extension  measure 

Mechanical 

equipment 

Analysis,  fatigue  test,  overhaul 

Mechanical  / 

Hydraulic 

equipment 

Sampling,  overhaul,  analysis,  fatigue, 
impulse  fatigue  and  endurance  testing, 
definition  of  inspection  and  overhaul 
procedure 

Electronic 

equipment 

Sampling,  definition  of  inspection  and 
overhaul  procedure 

Pipework 

Master  and  Zonal  inspections, 
overhaul,  definition  of  maintenance 
procedure 
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Equipment  / 
Component 

Life  extension  measure 

Hoses  (hydraulic 
fuel,  nitrogen) 

Sampling,  replacement  of  high 
pressure  and  nitrogen  hoses 

Standard  parts 

Review,  analysis 

Wiring 

Sampling,  Master  and  Zonal 
inspections,  definition  of  test  concepts, 
definition  of  inspection  and 
maintenance  procedure 

Attachment 

structure 

Review,  fatigue  analysis,  fatigue  test 

Following,  more  detail  informations  are  given  for 
various  subsystems: 

Landing  Gear  Subsystem 

General 

Landing  gear  systems  consist  of  very  different 
type  of  components,  as  for  instant  load  carrying 
structures,  electric  components  (switches,  relays, 
wiring  and  connectors,  circuit  breakers),  mechanical  / 
hydraulic  components  (piping,  couplings,  hoses, 
valves,  swivels,  actuators,  manifolds),  which  are 
necessary  to  provide  various  system  functions: 

Take  off,  landing  and  ground  operation  capability 
Retraction  &  Lowering  and  emergency  lowering 
Steering 

Braking  and  anti-skid 
Arrested  landing  capability 

Major  system  failure  modes  are: 

Collapse  of  gears  due  to  structural  failures 

Inability  to  lower  gears  by  the  normal  and 

emergency  system 

Loss  of  steering  and  braking 

Inability  to  provide  arrested  landing  capability 

Based  on  these  safety  critical  failure  modes,  which 
have  been  identified  in  the  System  Safety  Assessments 
Reports ,  a  list  of  safety  relevant  equipment  and 
components  have  been  established. 

It  should  be  noted  that  the  load  carrying  structure  is 
designed  according  safe  life  principles,  i.e.  a  crack  free 
structure  during  operation  is  mandatory  as  no  structural 
redundancies  are  provided.  Therefore  these 
components  have  been  categorized  either  as  CAT1  or 
CAT2,  for  which  life  extension  will  be  assessed. 

Other  equipments  for  which  life  extension  is  carried 
out,  are  for  instance  amplifiers,  valves,  servo  valves, 
main  wheel  brake,  hydraulic  swivels,  foot  motors, 
actuators,  locks,  nitrogen  bottle,  anti-skid  generator, 
etc. 


Life  extension  philosophy 

The  basic  philosophy  of  life  extension  of  landing 
gear  system  components  is 

Review  of  original  qualification  test  results 

Theoretical  assessments  of  the  fatigue  life  using 
existing  or  in-service  OLM  measurements 

Extended  fatigue  tests  of  structural  components 

Extended  endurance  and  impulse  fatigue  testing  of 
mechanical  /  hydraulic  components 

Investigation  of  high  aged  items  (sampling) 
regarding  their  physical  condition  after  4000  FH  in 
service  and  investigation  of  problem  areas 

Establishing  of  overhaul  and/or  revised  equipment 
maintenance  procedures  which  take  into  account 
aging  problems  as  experienced  during  sampling 
and  define  preventive  actions  for  further  safe  use 

Re-provisioning,  replacement  of  items  whose  life 
cannot  be  extended 

All  subsystem  components  which  are  critical  for 
the  retraction  &  lowering  function  as  actuators,  locks, 
but  also  attachment  lugs  have  already  been  subject  to 
life  extension  activities  and  evidence  for  an  extended 
use  up  to  16000  FH  has  been  already  demonstrated. 

Landing  gear  structure 

Life  extension  of  structural  components  of  the 
landing  gear  and  its  back-up  structure  are  of  special 
concern,  as  it  is  known  that  the  operational  loading 
conditions  have  changed  during  the  lifetime  of  the 
aircraft,  for  instance  due  to  the  increased  aircraft 
masses,  which  are  operated  today. 

It  was  therefore  decided  some  years  ago  to  carry 
out  an  extensive  in-service  operational  load 
measurement  program  (OLM)  to  investigate  the 
operational  loading  conditions  on  the  landing  gear 
back-up  structure  and  the  legs  with  the  aim  to  review 
existing  clearances  and  establish  the  basis  for  future 
life  extension  activities. 

Two  sets  of  gears  were  strain  gauged  and 
installed  in  a  GAF  and  RAF  aircraft  where  also  the 
attachment  and  back-up  structure  was  strain  gauged.  In 
total  more  than  325  flights  have  been  recorded  and 
assessment  of  the  measured  data  is  in  progress. 

As  these  aircraft  were  operated  in  different 
squadrons,  by  different  pilots,  with  different  masses 
and  different  store  conditions,  the  loading  information 
provides  a  good  cross-section  of  the  operational  service 
loading  of  the  landing  gear  and  its  back-up  structure  in 
different  air  forces. 
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Initial  results  of  these  investigations  showed  that 
the  loads  are  partially  much  more  severe  than 
originally  anticipated. 

The  influence  of  these  in-service  loads  on  landing 
structure  clearances  is  a  major  part  of  the  life  extension 
activities.  As  the  Tornado  Nose  Landing  Gear  (NLG) 
was  only  tested  up  to  the  original  life  requirement  of 
4000  FH,  it  was  decided  to  carry  out  a  new  fatigue  test 
taking  into  account  the  in-service  loading  conditions, 
which  take  place  on  MAFT  (Major  Airframe  Fatigue 
Test  specimen). 

For  the  Main  Landing  Gear  structure,  a  theoretical 
assessment  of  the  fatigue  clearance  has  started  and  later 
this  year,  when  this  assessment  will  have  been 
finalized,  a  decision  on  the  way  forward  will  be  taken, 
whether  or  not  an  additional  fatigue  test  will  be 
required  in  order  to  provide  the  best  possible  clearance 
statement. 

Landing  Gear  Equipment 

Landing  gear  equipment  life  extension  base  on 
the  topics  already  described  above.  Equipment 
suppliers  have  defined  their  requirements  by  reviewing 
own  experiences  of  the  in-service  behavior  of  their 
equipment. 

Mostly  they  have  required  different  numbers  of 
high  aged  equipment  from  service  for  investigation  of 
wear  and  tear,  corrosion,  fatigue  cracks,  etc. 

Review  of  the  original  qualification  and  test 
results  and  the  results  of  the  sampling  investigations 
were  primarily  used  to  establish  whether  life  extension 
of  the  equipment  is  possible  or  not.  If  life  extension 
seemed  possible,  the  method,  which  the  supplier  has 
agreed  with  the  SDR  ,  is  applied. 

Aging  problems  on  equipments,  which  have  been 
identified  so  far  (wear  and  tear,  leakage),  will  be 
covered  by  required  overhaul  at  the  end  of  the  original 
design  life  of  4000  FH  before  further  use  up  to  8000 
FH  will  be  allowed.  The  required  overhaul  should  also 
identify  the  serviceability  of  that  equipment  as  being 
the  prerequisite  for  further  use. 

Aging  and  age  related  problems 

It  has  been  already  shown  in  the  chart  (Fig.  2) 
that  the  failure  rate  for  aging  related  failures  has 
increased  over  the  last  10  years  by  approximately  50%. 

Wear  and  tear  and  leaking  are  the  major  reported 
failures.  For  extended  use  it  is  necessary  that  the 
problem  areas  are  identified  and  addressed  by 
modifications,  inspections  and  maintenance. 

Beside  the  life  extension  program,  a  very 
thorough  inspection  for  corrosion,  wear  and  tear  of 


high  aged  Main  and  Nose  Landing  Gears,  which  were 
in  service  for  more  than  15  years,  has  been  carried  out 

Corrosion  and  wear  has  been  found  in  some 
areas,  for  which  repairs  are  defined.  But  it  will  be  also 
important  to  address  these  areas  by  inspections  and  a 
revised  maintenance  policy. 

Two  areas  were  found  which  are  of  special 
concern  as  they  demonstrate  what  can  happen  if 
maintenance  procedures  are  inadequate  in  addressing 
aging  effects  in  time. 

These  areas  are  not  directly  inspectable  and 
would  require  partially  disassembly.  As  existing 
maintenance  procedures  do  not  require  disassembly  of 
the  gears  to  inspect  these  areas  it  could  happen  that  the 
gears  are  for  years  on  the  aircraft  or  in  stock  and  the 
condition  of  components  in  certain  areas,  which  are  not 
visible  inspectable,  are  not  known: 

1.  Severe  corrosion  has  been  found  on  the  outside  of 
the  tumable  MLG  shockabsorber,  Fig.  4,  which  is 
made  of  high  strength  steel  300M,  in  an  area, 
which  is  covered  by  the  Main  Fitting  and  belongs 
to  a  closed  volume  where  moisture  could  stay  for  a 
long  period  of  time.  Outside  of  this  area  no 
corrosion  was  found  on  the  shockabsorber. 


Fig.  4:  Corrosion  of  MLG  Shockabsorber 

It  is  considered  that  corrosion  is  to  be  due  to 
localized  attacks  of  the  base  metal  as  a  result  of 
prolonged  exposure  to  moisture.  It  is  assumed  that 
moisture  in  this  volume  is  a  result  of  condensation 
when  descending  from  altitude.  The  effect  of 
corrosion  with  regard  to  stress  corrosion  and 
fatigue  has  been  reviewed  and  not  considered 
critical  providing  an  inspection  program  is 
introduced  and  the  component  repaired  in  time. 
This  is  important  as  due  to  the  brittleness  of  the 
material  300M,  any  crack  in  this  area  could  cause 
immediate  fracture. 

An  inspection  procedure  has  been  issued 
which  address  this  area  in  a  timely  manner. 
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2.  Severe  corrosion  has  also  been  found  at  the  NLG 
Steering  Collar,  Fig.  5. 


Fig.  5:  Corrosion  found  at  the  NLG  Steering  Collar 


Access  to  this  area  requires  also  disassembly  of  the 
gear.  As  water  was  found  in  this  area,  it  is 
considered  that  the  sealing  becomes  insufficient 
with  time.  The  corrosion  became  so  big  that  the 
torque  moment  required  to  turn  the  slider  increases 
far  beyond  the  specified  values. 

Fortunately,  the  investigation  revealed,  that  repair 
is  possible,  if  the  repair  is  applied  in  time. 

Electronic  components 

All  electric  and  electronic  components  are 
sufficient  for  life  extension  with  the  exception  of  the 
Anti  Skid  Control  Box,  which  cannot  be  life  extended 
due  to  aging  problems  due  to  increasing  number  of 
failures  of  the  PCB  (printed  circuit  boards)  soldering 
joints.  A  repair  is  not  possible  because  the  components 
and  the  board  is  dipped  in  plastic  coating.  The 
exchange  of  PCBs  is  not  cost  effective  because  the  box 
shelf  represents  only  marginal  value  of  the  total  box 
price. 

Additional  there  are  other  aspects  related  to  the 
in-service  history  and  built  standard  of  Landing  gear 
components. 

Unfortunately  it  has  been  experienced  that  the  in- 
service  documentation  for  landing  gear  components  are 
not  always  available.  This  is  considered  to  be  a  very 
critical  situation  as  for  instance  landing  gear  structural 
components  are  of  safe  life  design  with  no  backup 
available.  The  ignorance  of  service  history  and 
consumed  life  creates  many  problems,  which  need  to 
be  addressed  urgently  otherwise  the  airworthiness  is 
difficult  to  control. 

In  case  no  history  can  be  established  any  more,  a 
risk  assessment  has  to  be  performed  for  each  gear  and 
replacement  of  items  before  reaching  its  final  life  could 


be  necessary.  This  situation  will  become  more  critical 
if  the  life  extension  activities  results  in  lower 
clearances  for  structural  components  than  original 
stated  due  to  different  in-service  loading  conditions. 

Fuel  Subsystem 

General 

The  major  function  of  the  fuel  system  is  to 
provide  engine  fuel  supply  under  all  normal  operational 
and  emergency  conditions. 

Two  major  safety  critical  system  failures  as  stated 
in  the  System  Safety  Assessments  Report  are 

Insufficient  engine  fuel  supply 
Fire  hazard  due  to  fuel  leakage 

Based  on  these  system  failures,  equipment  and 
components  have  been  identified  whose  failure  would 
lead  or  contribute  to  these  system  failures. 

Additional,  the  arrangement  of  the  fuel  system 
within  the  aircraft  fuselage  in  conjunction  with  the 
forced  ventilation  of  compartments  /  ducts  during 
aircraft  operations  has  been  considered  for  the 
assessment  of  the  fuel  system  component  safety 
categorization.  Consideration  of  the  general 
arrangement  and  operational  aspects  has  revealed  that 
fuel  leakage  or  fhel  mist  can  be  carried  from  the 
leaking  component,  which  may  be  located  in  an  area 
without  fire  /  explosion  hazard,  into  areas  with 
potential  ignition  sources. 

Life  extension  philosophy 

The  basic  philosophy  of  life  extension  of  fuel 
system  components  is 

Definition  of  inspection  and  overhaul  procedures 
for  safe  pipework  operation  beyond  4000  FH  up  to 
8000  FH.  This  will  be  supported  by 

•  Master  inspections 

•  Zonal  inspections 

Sampling  and  re-qualification  testing  for  fuel 
hoses 

Review  of  original  qualification  test  results  and 
compare  to  future  operational  usage  requirements 

Analysis 

Extended  qualification  by  endurance,  vibration  and 
pressure  cycling  tests 

Establishing  of  future  maintenance  policy  for 
equipments 

Following,  (preliminary)  results  from  the  life  extension 
work  will  be  presented. 


6-14 


Fuel  system  Pipework 

Fuel  pipework  is  of  special  concern  as  fuel 
leakage  due  to  a  broken  or  leaking  pipe  or  leaking 
coupling  could  significantly  contribute  to  safety 
relevant  hazards.  The  customer  requirement  for  fuel 
system  pipework  was  that  PANAVIA  should  define 
inspection  /  overhaul  procedures,  which  ensure  that  the 
safe  operation  of  the  pipework  is  ensured  up  to  8000 
FH. 


The  procedures  will  be  defined  by  analyzing  the 
findings  gained  during  Master  and  Zonal  Inspections , 
which  have  been  performed  on  two  high  aged  aircraft 
from  the  RAF  and  GAF  (fleet  leader)  during  aircraft 
depot  inspections  (DI). 

The  following  activities  have  been  part  of  the 
Master  Inspection : 

visual  inspection  of  all  fuel  system  pipework 
items,  associated  fuel  system  couplings  and 
support  /  attachment  parts 

examination  of  critical  elements,  which  have  been 
defined  prior  to  the  Master  Inspection.  Special 
emphasis  was  given  to  surface  damages,  corrosion, 
connection  and  attachment  areas,  dimensional 
checks 

proof  pressure  test  of  each  critical  element 

X-Ray  examination  of  all  welded  and  brazed  joints 

Fluorescent  penetrate  tests  of  all  welds 

NDT  investigation  of  critical  items  which 
experience  more  than  200  °C  during  service  in 
order  to  detect  materials  alteration  due  to  the 
exposure  to  high  temperatures 

Examination  of  seals 

definition  of  inspection  areas  and  maintenance 
measures  which  should  be  considered  for  the  final 
pipework  inspection  /  overhaul  procedure  to  be 
applied  on  all  aircraft  beyond  4000  FH 

Zonal  Inspections ,  which  took  place  on  two  RAF 
and  two  GAF  fleet  leader  aircraft,  based  on  the 
findings  of  the  Master  Inspection.  They  should  confirm 
the  findings  of  the  Master  Inspection  and  provide 
additional  practical  evidence  for  definition  of  the  final 
pipework  Inspection  /  Overhaul  procedure. 

Master  Inspections  have  revealed  that  there  were 
no  cracks  and  no  problems  with  welds.  The  only 
problem  related  to  aging  was  corrosion. 


40%  of  all  pipework  items  inspected  in  the  ventral 
duct  area  have  shown  corrosion 

28%  of  all  pipework  items  inspected  in  the  spine 
area  have  shown  corrosion 

Fig.  6  shows  the  propagation  of  intercrystalline 
corrosion  in  the  fuel  pipe  structure  (Aluminum)  in  the 
marked  area. 


The  findings  during  the  master  inspection  require 
inspections  and  an  optimized  maintenance  policy. 
Fortunately,  the  degree  of  corrosion,  which  was  found 
on  pipes  and  couplings,  need  no  immediate 
replacements  due  to  an  imminent  safety  hazard  but 
those  pipes  which  have  been  classified  as  “to  be 
scrapped”  have  been  replaced. 


Fig.  6:  Corrosion  on  a  fuel  pipe  and  Micrograph 
Examination  of  corrosion  mark 

Fuel  flexible  Hoses 


The  results  of  these  investigations  can  be 
summarized: 

Corrosion  was  detected  on  35%  of  all  pipework 
items;  14%  of  these  items  were  classified  as 
"reusable"  and  21%  as  "to  be  scrapped ' 


Flexible  hoses  using  Teflon  or  rubber  have  been 
defined  as  CAT  1  and  they  will  be  replaced  after  their 
certified  life  is  reached  (Teflon  hoses  after  4000  FH, 
rubber  hoses  after  6  years).  This  is  a  preventive 
measure  to  prevent  any  problems  with  material  aging 
and  consequently  leakage. 
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For  fuel  flexible  metallic  hoses  the  supplier  was 
tasked  to  carry  out  sampling  and  qualification  testing. 

A  sequence  of  different  testing  will  be  performed, 
which  comprises  of 

visual  inspection  and  dimensional  check 

proof  pressure  and  leakage  tests 

x-ray  and  fluorescent  penetrate  examination 

pressure  pulse  test 

vibration  test 

microscopic  examination 

The  results  of  these  tests  are  still  outstanding. 

Fuel  Valves 

During  the  Life  Extension  Program  those  valves 
were  considered 

where  high  stresses  are  caused  by  medium 
pressure  /  hot  fuel  environment  etc. 

where  in-service  experience  had  identified  units  to 
be  safety  critical  and 

which  are  installed  in  areas  where  any  leakage  will 
cause  a  fire  /  explosion  hazard.  On-condition 
operation  of  these  valves  beyond  their  certified  life 
of  4000  Fh  could  cause  additional  safety  hazards 
(fire  /  explosion),  since  the  failure  rate  which  has 
to  be  considered  for  these  valves  beyond  their 
certified  life  is  not  known. 

Each  valve  assembly  consists  of  the  valve  and  the 
actuator  assembly.  As  far  as  the  valve  assemblies  are 
concerned,  the  suitability  for  life  extension  is  related  to 
the  valves  only.  Methods  for  extending  the  life  of  the 
valves  beyond  4000  FH  will  be  defined  by  the  Supplier 
by  means  of  Master  Inspections  performed  with  sample 
units.  Part  of  this  Master  Inspection  are  the 

examination  of  all  parts  for  corrosion,  damage, 
wear  and  tear 

check  of  all  rubber  and  elastomeric  parts  for 
hardness  and  quality 

examination  of  all  critical  parts  with  non¬ 
destructive  and  X-ray  methods  (where  applicable) 

Direct  comparison  of  the  condition  of  the 
individual  sample  units. 

In  the  event  that  the  approved  method  of 
achieving  the  required  8000  FH  Life  Extension  should 
entail  Life  Extension  Qualification  Testing,  then  this 
testing  in  general  will  comprise  endurance  and 
vibration  testing 

The  Supplier  has  declared  all  actuator  assemblies 
unsuitable  for  Life  Extension  due  to  their  suspected 


poor  in-service  MTBF  and  known  design  limitations. 
He  proposed  therefore  to  replace  these  actuator 
assemblies  with  superior  equipment.  These  consist  of  a 
permanent  magnet  motor,  which  negates  the  use  of  the 
clutch  assembly  currently  used  on  the  Tornado 
actuators  and  offers  improved  switching  characteristics 
with  self-cleaning  action.  The  new  actuator  will  also 
offer  better  reliability  than  the  existing  one,  consist  of  a 
hermetically  sealed  electrical  connector  and  provides 
better  EMC  performance. 

Fuel  subsystem  equipment 

Many  equipment  from  the  fuel  subsystem  are  part 
of  life  extension  activities  as  they  have  been  classified 
as  safety  relevant.  These  items  are  manly  different  type 
of  pumps,  flexible  sliding  joints,  thermal  diffuser,  etc. 

Current  results  of  the  life  extension  process  from 
sampling,  analysis  and  re-qualification  revealed  that 
most  of  these  equipment  could  be  life  extended.  The 
DDPs  will  state  the  revised  clearances  and  additional 
requirements  for  overhaul  in  some  cases. 

For  the  double-ended  boost  pump,  the  electrical 
harness,  which  is  a  safety  critical  component  (high 
voltage  power  line  which  is  submerged  in  fuel),  shall 
be  replaced  after  its  original  design  life  limits  are 
reached. 

Life  extension  of  fuel  coolers  requires  surge 
pressure  measurements  to  establish  in-service  realistic 
conditions. 

Fuel  Tanks 

The  Tornado  fuel  tanks  consist  of  bladder  type 
cells  of  different  construction.  The  tanks  are  not  part  of 
the  life  extension  program  as  PANAVIA  has  already 
recommended  to  maintain  the  tanks  in  accordance  with 
an  " on-condition"  lifing  policy  with  no  significant 
adverse  effect  on  the  flight  safety  of  the  aircraft, 
although  reliability  may  be  degraded. 

Electrical  Wiring 

General 

Electrical  wiring  is  used  all  over  the  aircraft  in  all 
flight  systems.  Cable  looms  are  distributed  in  and 
through  many  zones  of  the  aircraft,  where  different 
environmental  conditions  exist  as  for  instant  heat, 
moisture,  in  case  of  leakage  fuel,  hydraulic  oil,  but  also 
vibration,  acoustic,  etc.  All  these  environmental  effects 
need  to  be  assessed  for  life  extension  of  the  electrical 
wiring. 

The  general  design  philosophy  of  the  electrical 
system  is  as  for  other  flight  safety  critical  systems,  that 
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no  single  failure  does  cause  a  hazardous  situation. 
Therefore  the  wiring  system  is  categorized  as  CAT3. 

However  wiring  degradation  with  time  is  a 
significant  problem  as  if  not  maintained  it  could  cause 
a  hazardous  situation. 

Wiring  can  fail  in  two  ways: 

a)  as  an  open  circuit  conductor  and 

b)  with  a  short  circuit  to  another  wire  or  frame 

Case  a)  is  not  considered  to  be  safety  critical  as 
flight  systems  are  of  fail-safe  design.  It  is  assumed  that 
any  functional  failure  within  a  flight  system  caused  by 
the  wire  failure  will  be  found  by  functional  on  aircraft 
tests. 

Case  b)  is  the  much  more  significant  failure  as  a 
short  circuit  to  a  metallic  component  or  another  wire 
can  produce  an  electrical  arc  which  in  turn  can  cause  a 
hazardous  arcing  condition. 

The  probability  of  this  failure  condition  is 
considered  to  be  quite  small,  as  a  series  of  correct 
conditions  need  to  be  present  in  the  same  time.  But 
with  increasing  age  of  the  wiring  this  probability  will 
increase  and  thorough  inspections  need  to  be  placed  in 
order  to  slow  down  the  increase. 

Life  extension  philosophy 

It  has  been  evaluated  that  life  extension  of  wiring 
by  extended  qualification  activities  may  not  lead  to  a 
life  increase,  as  it  could  be  shown  that  the  consumed 
life  is  dependent  on  many  factors  which  accelerate  the 
aging  of  the  wire  insulation.  Such  factors  are  for 
instance  the  location,  contamination  by  aggressive 
fluids,  heat  but  also  maintenance  activities  by  which 
the  wire  looms  are  manipulated. 

Therefore,  the  definition  of  a  most  cost-effective 
maintenance  policy  is  the  basic  strategy  for  Tornado 
wiring  life  extension. 

The  following  engineering  activities  are 
performed  and  methods  investigated: 

Assessment  of  the  suitability  of  the  RAF  WIDAS 
(Wire  Insulation  Deterioration  Analysis  System)  as 


Infrared  Thermography  (IRT)  for  detection  of  wire 
failures  or  high-risk  conditions  will  be 
investigated. 

Wire  extended  qualification  testing  in  conjunction 
with  the  supplier.  These  tests  consist  of  dry  and 
wet  arc  and  thermal  life  tests.  Tests  will  be 
conducted  by  an  independent  laboratory  and  tests 
results  send  to  the  wire  manufacturer  for 
assessment. 

Investigation  of  other  methods  including  high 
voltage  (HV)  testing. 

Review  of  other  existing  wiring  policies  within 
airlines,  wire  manufacturer,  etc. 

Electrical  wiring  survey 

An  investigation  of  the  wiring  condition  in  a  large 
number  of  aircraft  (49)  has  been  performed  in  order  to 
assess  the  state  of  wiring  within  different  aircraft, 
which  are  operated  in  different  air  forces,  at  different 
environmental  conditions,  which  are  subject  to 
different  maintenance,  etc. 

It  has  been  established  that  wiring  deterioration  is 
dependent  mainly  on  the  four  topics: 

a)  Applied  maintenance  policy: 

•  Better  quality  of  preventive  maintenance 
(removing  of  oil  leakage,  dirt,  ...)  results  in 
better  condition  of  the  wiring  system. 

•  The  use  of  de-humidifiers  has  a  significant, 
positive  influence  on  the  level  of  corrosion. 

b)  Operational  environment: 

•  Aircraft  operating  under  coastal  or  wet 
climatic  conditions  have  shown  more 
electrical  and  general  corrosion. 

•  As  the  aircraft  spend  only  2%  of  their  total  life 
flying,  the  conditions  of  the  hangars  are 
important  regarding  deterioration  effects: 
warm  and  dry  hangar  conditions  have  positive 
effects  compared  to  the  aircraft  standing 
outside. 


a  sampling  tool  that  provides  for  a  preventative 
maintenance  program  of  timely  wire  replacement. 

Zonal  analysis  (ZA),  identifying  the  risk  of  wiring 
failure  on  a  zone  by  zone  basis  considering  the 
environment  and  other  components  installed  in  this 
zone.  The  main  objective  of  these  activities  is  to 
identify  risk  areas  that  would  allow  the  definition 
of  dedicated  maintenance  policies.  These  areas 
could  then  be  subject  to  further  investigation  by 
other  methods.  The  definition  of  risk  areas  would 
also  remove  the  need  of  further  investigation  of 
low  risk  areas  and  so  reduce  costs. 


•  Long  duration  flights  at  high  altitude  in  dry  air 
lead  to  a  better  state  of  the  wiring  system 
compared  to  for  instance  trainer  aircraft, 
which  perform  much  more  cycles  (take  off 
and  landing)  and  fly  in  lower  height  with 
much  higher  air  humidity 

c)  Materials  used  in  the  wiring  system 

•  Embrittlement  and  dry-out  of  tie  wraps 
exacerbate  chafing  at  tie  wraps  position, 
especially  where  tie  wraps  have  been  applied 
too  tightly  when  fitted,  which  could  be  the 
result  of  unsuitable  tooling. 
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•  Use  of  heavy  plastic  spiral  wrapping  as  a 
sleeving  on  flexible  looms  is  unsuitable  as 
encouraging  insulation  cracking  at  the  point 
where  the  flexible  part  leaves  the  main  loom. 

•  Perished  rubber  sleeves  if  they  perish  allow 
the  wiring  loom  to  open  up,  which  could  lead 
to  increased  chafing  and  rubbing 

•  Use  of  heat  shrink  material  is  not  suitable  as 
flexible  looms  become  hard  and  can  make 
wiring  looms  rigid. 


Replacement 

Mechanical,  hydraulic  components 

The  majority  of  safety  relevant  components  have 
equipment  DDPs,  which  define  operational  and  other 
life  limits. 

Life  extension  of  hydraulic  components  such  as 
actuators  will  be  based  on  sampling  of  high  aged 
equipment,  theoretical  assessment  of  possible  further 
life  potential,  re-qualification  programs  where  possible 
and  overhaul  at  defined  intervals. 


d)  Time  in  service: 

•  It  has  been  established  that  contamination  of 
the  wiring  system  by  dirt  and  oil  can  be 
related  to  the  aircraft  age  but  is  also  dependent 
on  the  frequency  of  cleaning  activities 

The  findings  of  this  survey  will  be  used  to  establish 
recommendations  for  further  usage  of  the  wiring 
system  for  a  limited  period  of  time. 

Flight  Control  System 

General 

The  flight  control  system  consists  of  various 
components,  as  for  instance  hydraulic  and  mechanical 
actuators,  ball-screw  actuators,  electrical  motors, 
computers,  wiring,  switches,  control  rods,  lever,  etc.. 
As  for  other  systems,  the  effect  of  failures  of  any  FCS 
component  on  flight  safety  hazards  has  been 
investigated  taking  into  account  the  system  hazards  as 
defined  in  the  safety  analysis  documents. 

The  major  problems,  which  have  been  identified 
for  many  components,  are  related  to  fatigue  and 
endurance.  Failures  due  to  wear  and  tear  are  the  most 
reported  service  failures  (Fig.  2). 

Life  extension  philosophy 

Although  the  FCS  consists  of  a  variety  of 
different  components,  such  as  mechanical/hydraulic  as 
well  as  electric/electronic  components,  life  extension  of 
these  equipment  will  base  on  the  following  general 
work: 

Sampling  of  high  aged  ex-service  units 

Analysis  of  the  MTBF  data. 

Theoretical  analysis  of  life  potential 

Re-qualification  tests  (endurance,  fatigue) 

Investigation  of  aging  effects  on  materials 
and  components  by  sampling 

Establishing  of  overhaul,  maintenance 
procedures 


Life  extension  of  mechanical  components  as  for 
instance  linkages,  control  rods,  control  stick  rods, 
levers  and  rudder  pedal  mechanism  are  covered  by  the 
structure  statement  (chapter  2)  and  no  fatigue  life 
extension  activities  are  necessary. 

Flight  Control  Computers 

The  Flight  Control  Computers  are  designed  and 
constructed  according  to  MIL-Specs  and  safety 
requirements  and  consist  of  a  triplex  multi-channel 
computing  system  in  two  computer  boxes  (Lateral  and 
Pitch),  Fig.  7  (CSAS  computer). 


Fig  7:  CSAS  computer 

The  technology  used  in  these  computers  is 
developed  in  the  seventies  and  is  therefore  no  longer 
state  of  the  art.  In-service  support  becomes  more 
difficult  the  longer  the  computers  will  stay  in  service. 

Within  the  life  extension  program  the  supplier 
have  investigated  various  computer,  which  have  been 
in  service  nearly  4000  FH.  The  general  result  of  the 
survey  is  that  only  partially  degradation  of  equipment 
was  found  which  could  be  directly  attributed  to  aging. 
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Some  problems  have  been  found  which  could  be 
regarded  to 

poor  standard  of  repair  and 

the  application  of  conformal  coating 

but  it  is  considered  that  these  findings  will  not  degrade 
the  functional  performance  and  also  reliability. 

Additional,  minor  damages  were  found,  which 
could  be  caused  by  mishandling  during  maintenance 
work.  It  is  therefore  proposed  to  review  the  current 
handling  practices  so  that  no  undesirable  mechanical  or 
electrical  failures  are  introduced,  which  could  have  an 
influence  on  the  performance. 

The  survey  of  aged  electronic  components  has 
revealed  additional  problem  areas  as  following 
described. 

Aging  problems  with  electronic  components 

Relays 

Relays  are  not  pure  electronic  components 
but  consist  of  many  mechanical  parts  like  springs, 
special  contacts,  coil  and  printed  circuits  and  all 
parts  are  subject  to  continuous  aging. 

Relays  are  designed  for  a  certain  (high) 
number  of  operations  and  the  degradation  of  the 
contact  will  result  in  an  increase  of  contact 
resistance. 

The  relays  which  have  been  investigated  in- 
depth  were  found  in  a  good  condition  and 
replacement  is  only  proposed  if  any  failure  is 
found  or  if  they  are  physically  damaged. 

Potentiometers 

Variable  resistors  include  mechanical  and 
“Pertinax”  parts  which  produce  an  electronic 
resistor  by  moving  a  mechanical  part  on  the 
surface  of  a  small  “Pertinax”  part. 

During  the  aging  process,  environmental 
conditions  and  load  could  have  an  adverse  effect 
on  the  performance  of  this  type  of  resistor,  which 
might  result  in  a  negative  influence  on  the  Build- 
In-Test-Equipment  (BITE). 

Investigation  of  aged  potentiometers  has 
revealed  in  some  cases  a  degradation  of  the  case 
seal  and  also  the  existence  of  hairline  cracks, 
which  would  under  certain  conditions  allow  the 
ingress  of  moisture. 

It  is  therefore  proposed  to  investigate  the 
general  mechanical  and  functional  condition  of 
these  components  and  replacement,  if  the 
component  is  defined  as  unserviceable. 


Capacitors 

Capacitors  of  different  style  are  used. 

Aging  problems  have  been  experienced  for 
instance  with  ’castanet’  wet  tantalum  capacitors. 
The  major  findings  are 

change  in  state  of  the  liquid  electrolyte,  in 
which  gas  bubbles  have  been  found 

loss  of  the  electrolyte  which  results  in 
corrosion  around  the  anode/cathode  seal, 
which  results  in  a  reduction  of  the  capacitance 
value  (pF). 

Printed  Circuit  Boards  (PCB) 

PCBs  in  old  computers  are  partly  wired. 
Furthermore,  they  carry  connectors  for  the  Dual 
Card  Assemblies. 

Problems  have  been  experienced  with 
surface  leakage  currents,  which  could  be  a 
dormant  failure,  contamination  and  condensates  in 
conjunction  with  humidity. 

Also  local  delamination  of  the  top  layer  of 
the  PCB  was  found  in  areas  where  solder  pads 
have  been  repaired  and  probably  excessive  heat 
were  introduced.  It  is  therefore  considered  that  the 
delamination  is  attributed  to  poor  standard  in- 
service  rework. 

Additionally,  aging  of  the  PCB's  solder 
joints  have  been  found,  as  shown  in  Fig.  8. 

Connectors 

Similar  problem  as  described  for  the  PCBs 
have  been  experienced  with  connectors,  which 
have  connections  to  the  PCBs  and  to  the  wiring  via 
solder  joints. 

Wiring  (within  Computers) 

The  major  problems  with  wiring  within  the 
computers  are  cable  chafing  with  nuisance  effects. 

Resistors 

It  has  been  experienced  that  aging  could 
change  the  tolerance  of  resistors.  Therefore  the 
logic  circuit  which  the  related  resistor  belongs  to 
will  change  and  this  can  produce  failures  and  No- 
Go's  during  BITE. 

Transistors ,  Integrated  Circuits  (ICs),  OP- 
amp  lifters 

Load-Life  during  different  usage  of  the 
aircraft  and  maintenance  may  stress  these 
electronic  components. 
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Fig.  8:  Aged  solder  joints  of  PCB's 


Influences  of  operational  Environment 

The  Tornado  aircraft  is  operated  by  different 
airforces  in  different  environmental  conditions.  The 
Tornado  is  also  used  as  a  Navy  variant.  Therefore  very 
different  operational  conditions  exist,  which  have  a 
different  influence  on  aging. 

The  following  should  describe  briefly  the  major 
environments  which  contribute  to  aging  of  electronic 
components  of  the  Flight  Control  Computers  and 
which  influence  is  assessed  during  the  life  extension 
work: 

BITE-Runs  (Preflight/First  Line) 

High  altitude  flights 

Power  ON/OFF  cycles 


Different  Weather  conditions  such  as  high/low 
temperature,  high  humidity,  lightening,  salty 
atmosphere 

An  example  for  corrosion  due  to  environmental 
influences  is  the  corrosion  around  power  resistor  leads 
found  due  to  Doghouse  -  environmental  influence,  Fig. 
9. 


Fig.  9:  Corrosion  around  power  resistor  leads 

Additional,  the  following  influences  could  have  a 
degrading  effect  on  component  integrity 

Operation  in  Navy  /  Air  Force 

The  Tornado  is  designed  for  different  combat 
roles.  The  equipment,  which  is  operated  within 
Navy  aircraft,  is  exposed  to  salty  atmosphere  and 
therefore  the  effect  of  corrosion  becomes  more 
critical  for  these  types  of  aircraft  as  they  are  often 
flying  over  ocean. 

Wars 

Wars  like  the  past  Gulf  and  Bosnia  will  have 
special  influence  as  normal  flying  in  squadrons 
from  home  base.  Heavy  stores  and  more  agile 
flying  will  stress  not  only  the  airframe  but  also  the 
electronic  equipment  (cards,  boxes,  wiring, 
connectors). 

Parking 

Normal  Parking  of  A/C  in  a  shelter  with  covers  on 
all  potential  sensors  like  the  ADD-Probe  is  needed 
for  a  long  life.  Parking  on  and  outside  airfield  and 
sensors  not  covered  is  a  potential  hazard  for  fast 
aging  of  electronic  equipment  and  their  sensoric 
system. 

Storage 

Storage  of  electronic  equipment  is  not  the  same  as 
for  mechanical  parts.  The  electronic  items  will  age 
under  these  conditions  as  well  as  under  normal 
usage. 
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To  investigate  the  life  consumption  of  electronic  parts, 
the  correct  service  history  need  to  be  assessed. 
Therefore  it  is  essential  that  configuration  control  is 
possible  for  all  critical  equipment  and  components. 

Life  extension  of  FC  computer  by  overhaul 

As  for  other  equipment,  the  supplier  will  give  a 
guarantee  for  his  equipment  only  for  usage  within  the 
specified  operational  and  life  limits. 

Extended  qualification  of  the  Flight  Control 
Computers  was  discussed  to  fulfill  the  customer 
requirements  for  life  extension.  But  due  to  the  high 
costs  of  this  re-qualification  process  a  different 
approach  was  examined  with  the  supplier  customer. 

It  was  decided  that  life  extension  of  the  FC 
computer  will  base  on  overhaul  after  the  equipment  has 
reached  its  certified  service  life. 

The  procedure  base  on  knowledge  of  the  supplier 
maintenance  work  and  by  sampling  of  high  aged 
service  equipment: 

Survey  of  early  manufactured  computers  to 
identify  time  dependent  effects,  which  will  be  used 
to  produce  test  and  inspection  procedures 

Research  failure  and  repair  records  required  from 
service 

In  depth  investigations  of 

-  PCBs 

Connections 

Active  components  (i.e  transistors) 

Passive  Components  (i.e  capacitors) 

Case  structure 

These  investigations  will  be  used  to  establish 
overhaul  procedures  for  the  different  type  of 
computers.  These  procedures  are  currently  under  strong 
discussion  with  the  customer  and  the  suppliers  and  the 
following  general  measures  are  foreseen: 

Detail  examination  of  the  physical  condition, 
identifying  of  aging  problems  and  components 
which  need  to  be  replaced 
functional  check 
cleaning 

EMC  Test:  Early  standards  of  the  Flight  Control 
Computers  are  EMI  hardened.  Therefore  an  EMC 
test  will  be  conducted  after  the  overhaul  procedure 
has  been  successfully  performed. 

Conducting  of  an  Automatic  Test  Procedure  (ATP) 
Release  to  service 

Obsolescence  of  electronic  components 

Review  of  the  availability  of  electronic 
components  for  the  FCS  computer  revealed  that  the 
obsolescence  problem  becomes  more  and  more  critical. 


To  overcome  this  situation  the  following  options  are  in 
discussion: 

a)  Lifetime  buy  of  components,  which  will  be  no 
more  available  in  the  future.  Presently  up  to  50 
electronic  components  are  no  more  available  on 
the  market.  This  concerns  especially  FET 
switches.  Power  Transistors,  PROMs,  Optic 
couplers,  special  A/D  converter,  TTL  components, 
Resistor  -  Thickfilm  networks,  etc. 

b)  Redesign  using  actual  standards  of  components 
and  modem  production  processes  to  achieve 
compatible  equipments  on  LRU  level. 

c)  Development  of  new  concepts,  new  technology 
with  new  hardware  as  well  as  software,  together 
with  limited  measures  related  to  alternatives  a)  and 
b)  for  the  interim  period  of  years  until  completion 
of  introduction  in  service. 

Presently  the  way  forward  is  not  yet  decided  and  will 
base  on  the  experience  and  requirements  established 
within  the  life  extension  program 

Hydraulic  System 

General 

Safety  relevant  hydraulic  subsystem  equipment 
and  components  have  been  identified  based  on 
assessment  of  the  System  Safety  Assessments  Report. 

The  major  subsystem  failures  modes  are 

Loss  of  hydraulic  power  and  hydraulic  flow  which 
would  lead  to  loss  of  aircraft  control 

Loss  of  emergency  equipment  function  required  in 
the  event  of  an  emergency 

The  evaluation  of  age  related  system  failures,  Fig.  2, 
have  shown  that  leakage  is  the  most  significant 
reported  in-service  occurrence,  which  is  well 
understood,  as  endurance  of  hydraulically  functional 
equipment  will  lead  over  time  to  a  degradation  of  the 
seals.  This  means  that  the  older  the  equipment  stays  in 
service  the  often  unscheduled  maintenance  will  be 
required  to  address  these  problems. 

Life  extension  philosophy 

The  life  extension  philosophy  for  the  hydraulic 
subsystem  equipment  and  components  base  mainly  on 
sampling  and  re-qualification  of  equipment  and  the 
definition  of  maintenance  and  overhaul  requirements. 

A  Master  Inspection  for  investigation  of  the 
condition  of  hydraulic  subsystem  components  in  aged 
aircraft  is  currently  not  performed. 
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Hydraulic  Subsystem  equipment 

Many  equipment  and  components  have  been 
selected  for  life  extension  as  for  instance  pumps, 
pressure  switches,  accumulator,  valves,  self  sealing 
couplings,  reservoir,  slide  and  swivel  joints,  etc. 

Aged  equipment  from  service  have  been 
delivered  to  the  suppliers  for  detail  investigation  of  the 
condition  after  4000  FH  in  service  and  to  state  the 
serviceability  for  further  usage. 

Most  of  the  hydraulic  equipment  will  be  re¬ 
qualified  by  extended  impulse-fatigue  tests,  endurance 
and  fatigue  tests. 

Current  results  indicate  that  most  of  the 
equipment,  which  are  subject  to  life  extension,  will  be 
suitable  for  8000  FH.  An  overhaul  after  4000  FH  will 
probably  be  required  by  the  supplier  after  the  original 
specified  life  is  reached. 

During  this  overhaul  the  units  will  be  resealed 
and  areas,  which  have  shown  wear  and  tear  needs  to  be 
repaired,  if  necessary. 

Aging  of  equipment  (corrosion,  wear  and  tear)  as 
well  as  contamination  of  e.g.  filters  need  to  be 
addressed  by  appropriate  in-service  maintenance 
procedures. 

Hydraulic  piping 

Fatigue  life  of  hydraulic  pipes  is  not  of  concern. 
Therefore  no  activities  for  life  extension  are  foreseen. 

Aging  effects,  as  corrosion  of  the  high-pressure 
steel  pipes  need  to  be  addressed  by  appropriate 
maintenance  activities.  Nevertheless,  leakage  is  not 
considered  as  safety  critical  and  severe  leakage  will  be 
detected  early  by  pre-flight  or  post  flight  checks. 

Hydraulic  hoses 

Life  extension  of  hydraulic  hoses  is  in  discussion 
and  there  will  be  different  solutions  for  high  and  low 
pressure  hoses.  It  is  likely  that  high-pressure  hoses 
need  to  be  replaced  after  normal  service  life. 

Significant  aging  effects  on  high  aged  hoses  have 
not  been  experienced. 

Environment  Control  System 

General 

The  ECS  subsystem  consists  of  a  number  of  sub¬ 
subsystems  as  for  instance  cabin  pressurization,  engine 
anti-icing  system,  temperature  control  system, 
windscreen  heating  system,  etc. 


Again,  based  on  the  original  System  Safety 
Assessments ,  safety  relevant  equipment  have  been 
identified  and  the  customer  has  defined  equipment  for 
which  life  extension  should  be  carried  out. 

Mainly  all  equipment  and  components,  which 
belongs  to  the  high  pressure  and  high  temperature  part 
of  the  ECS  system  and  subject  to  engine  bleed  air 
conditions  are  critical. 

The  components  which  belongs  to  the  low 
pressure  ECS  part  are  categorized  as  non  safety 
relevant.  No  specific  life  extension  measure  are 
foreseen  and  also  no  investigations  into  aging  problems 
are  performed. 

Life  extension  philosophy 

Life  extension  measures  for  ECS  equipment  and 
components  are  basically: 

Sampling  of  aged  equipment 

Stress,  fatigue  analysis 

Definition  and  conduction  of  re-qualification  tests 

Master  inspection  for  critical  zones  of  intercooler 
ejector  line 

Definition  of  maintenance  procedures 

ECS  Subsystem  equipment 

Equipment,  which  is  subject  to  life  extension 
activities,  are  for  instance  valves,  pre-cooler,  reservoir 
bottle. 

These  items  are  subject  to  life  extension  measures 
as  defined  before.  The  investigation  of  aging  effects  on 
equipment  is  performed  during  sampling  of  high  aged 
components. 

ECS  ducting  system 

A  Master  Inspection  is  proposed,  which  should 
investigate  the  critical  zone  of  the  intercooler  ejector 
line. 

The  main  objectives  of  the  Master  Inspection  are 

Investigation  of  installation  aspects  to  support  of 
life  extension  of  ducts  and  critical  bellows 
including  investigation  of  bellows  inner  condition 
to  enable  decision  for  re-qualification  testing  of 
bellows  /  structural  interface 

Investigation  of  the  physical  condition  related  to 
aging  aspects,  mainly  external  corrosion  beneath 
the  insulation 

The  investigations  have  not  yet  started. 
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Part  4 

Conclusion 

The  Tornado  life  extension  program  was  defined 
to  extend  the  life  of  the  aircraft  up  to  8000  FH.  Within 
this  program,  which  is  still  in  progress,  a  clear  process 
has  been  defined  for  subsystem  life  extension,  which 
focuses  mainly  on  safety  relevant  equipment  and 
components. 

Part  of  this  process  are  investigations  into  the 
aging  condition  of  equipment  and  components,  which 
are  near  to  the  end  of  their  certified  life.  The  results  of 
these  investigations,  mainly  got  by  sampling  of  aged 
equipment,  Master  and  Zonal  Inspections,  are  used  to 
support  the  definition  of  requirements  for  further 
extended  use  of  equipment  beyond  their  certified  life. 

Aging  problems,  such  as  corrosion,  wear  and  tear, 
leakage,  or  degradation  of  electronic  components,  etc. 
have  been  identified  in  many  subsystems  but 
fortunately  none  of  them  required  immediate  action  to 
prevent  a  safety  critical  hazard.  Aging  problems  will  be 
addressed  by  overhaul,  repair  or  replacement  actions, 
dependent  on  the  condition  of  the  item  investigated,  but 
also  on  factors  like  economics,  spares  availability  and 
overall  fleet  management. 

Experiences  we  made  during  the  time  carrying 
out  the  life  extension  program: 

Supplier  are  mostly  unaware  of  the  in-service 
experience  with  their  equipment 

Strong  and  time  consuming  discussions  were 
necessary  between  customer,  SDR  and  supplier  to 
define  a  by  all  involved  parties  agreed  approach 
for  life  extension  for  certain  equipment 

Service  history  and  life  consumption  cannot  be 
provided  for  many  equipment,  which  means  that 
the  point  where  the  equipment  should  be  subject  to 
agreed  life  extension  measures  (i.e.  overhaul, 
replacement  of  the  complete  unit  or  detail  parts)  is 
difficult  or  even  not  possible.  Recording 
equipment  life  woulf  help  minimising  operating 
costs  as  the  full  performance  of  the  equipment  can 
be  used. 

Non  availability  of  service  documentation  resulted 
in  the  fact  that  provision  of  suitable  loan 
equipment  for  investigation  at  the  supplier  was 
difficult  to  locate. 

The  effort  unertaken  to  re-qualify  equipment 
beyond  their  original  certified  life  is  often 
significant.  Since  in  the  Tornado  program  most 
equipment  have  in  nthe  past  only  been  quaified  up 
to  their  original  specification  requirements  it 
should  be  considered  much  more  cost  effective,  if 


the  equipment  would  have  been  tested  to  failure 
ideally  just  after  normal  qualification  to  spec  has 
been  completed. 

As  general  conclusion  it  can  be  stated  that  life 
extension  of  Tornado  subsystems  is  successful  as  in 
many  cases  the  customer  requirements  can  be  met. 

PANAVIA  and  their  supplier  have  or  will  clearly 
specify  overhaul,  inspection  and  maintenance 
requirements  for  equipments  which  failure  would  be 
hazardous  and  which  should  be  mandatory  for  further 
safe  operation.  Aging  aspects  will  be  covered  by  these 
inspection  requirements. 


References: 

1.  PDT  1299:  TORNADO  Life  Extension  Process 
Definition  Document 

2.  PDT  1299  Phase  A  Report 

3.  Various  reports  and  presentations  of  inspection 
results 
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PDT  1299:  Life  Extension  Phase  A/B 


Phase  A  -  PANAVIA  /  NETMA  /  NATIONS 

Compile  lists  of  equipment  Using  original  System  Identify  failure  modes  of 

for  each  system  (from  — ►  Safety  Assessment  — ►  system  leading  to  a  — ► 

WUC  list)  Reports  hazardous  situation 

Identify  equipment 
contributing  to  each 
hazardous  situation 

1 

t 

Prepare  a 
proforma  for 
this  equipment 

Produce  Phase  A  Review  conducted  -Phase  All 

— ►  report  — ►  decided  — ► 

Phase  All  categories 
defined 

Phase  All  -  PANAVIA  /  NETMA  /  NATIONS 

Each  system  proformas 
reviewed 

Determine  safety  Update  each  proforma  _► 

relevance  category 

Update  each  system 
report 

Phase  B  -  NETMA  /  NATIONS 

System  Reviews  — ► 

Equipment  _  Decision  on  which  to  Phase  B  meeting  TF 1/2/3  prepared 

Assessment  extend  life  report  defining  equipment 

to  be  funded 

Life  Extension  Phase  C  &  D  for  Flight  Systems  &Equipment 

(Items  shown  in  bold  letters  indicate  customer  /  operator  dependency) 


Phase  C 

TF2  prepared 

costs  defined  to  equipment 
level 

Nations  consider  technical 
solution  and  cost 
effectiveness 

TF3  issue  authorising 

Phase  C  activity  for  chosen 
items 

i 

* 

PANAVIA 
authorises  ^ 

supplier  to 
commence  work 

Operators  provide 
item(s)  required 

Supplier  conducts  Supplier 

— ►  assessment  and/or  — ►  produces 

calculations  /  report 

qualification  requested 

DDP  for 

— ►  extension  issued 

to  PANAVIA 

Phase  D 

Equipment  NSR  & 
2.5.3  identified 

- 

Interim  4500  FH  aircraft 

Life  Extension  DDP  — ► 

supplement  produced  & 

issued 

i 

♦ 

Lifed  items 
identified 

- 

Items  not  required  to  be 

extended  are  identified  ”► 

PANAVIA  Lifed  Items 

List  to  be  updated 
progressively 
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Process  for  identification  of  Life  limited,  Safety  Relevant  PANAVIA 

Standards 


(except  where  inspection  is  required) 
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Today,  safety  is  considered  to  be  of  highest  importance 
in  most  societies.  In  the  context  of  the  military,  safety  is 
essential  to  averting  loss  of  life  and  damage  to  a  high- 
value  asset.  While  safety  may  take  second  place  to 
winning  a  war,  its  importance  is  further  accentuated 
because  of  its  connotation  to  battlefield  readiness.  There 
have  been  numerous  instances  to  illustrate  this  last 
point.  To  wit: 

-  Widespread  Fatigue  Damage  (WFD)  was 
discovered  in  “weep  holes”  of  fuel  tanks  of  some 
C- 141  military  transport  airplanes.  Because  of  the 
loss  of  minimum  residual  strength,  with  the 
attendant  risk  of  catastrophic  fracture  posed  by 
WFD,  the  entire  fleet  had  to  be  grounded  and  an 
expensive  refurbishment  program  had  to  be 
undertaken  before  the  fleet  was  deemed  to  be 
airworthy.  In  this  instance,  the  unsafe  condition  was 
detected  and  corrected  quickly,  so  no  lives  were  lost 
nor  did  any  of  the  airplanes  in  the  fleet  suffer 
catastrophic  damage.  However,  the  grounded 
aircraft  were  certainly  not  battle-ready  for  a  certain 
length  of  time.  Had  they  been  sent  into  battle,  they 
would  have  had  to  be  operated  under  severe  flight 
restrictions  and,  thus,  their  utility  to  serve  the 
purpose  of  the  deployed  forces  would  have  been 
very  restricted.  Had  they  been  deployed  without 
any  restrictions,  in  all  probability  they  would  have 
been  unable  to  complete  their  missions  and  the  Air 
Force  could  have  lost  valuable  aircraft  assets.  Also, 
the  necessary  logistic  support  to  properly  carry  out 
tactical  operations  in  the  battlefield  would  not  have 
been  available. 

-  WFD  was  the  primary  cause  of  a  highly  publicized 
air  accident  involving  a  commercial  aircraft.  The 
wide  publicity  given  to  that  single  accident,  abetted 
by  on-site  video  tape  recording  of  the  condition  of 
the  aircraft  after  it  had  landed,  shook  the  confidence 
of  the  public  in  the  safety  of  commercial  aviation. 
As  a  result,  inspection  and  refurbishment  of  3000 
jet  transport  airplanes  among  a  fleet  of  about  5000 
was  mandated  by  the  authorities,  to  be  undertaken 
on  an  urgent  basis.  The  economic  impact  of  this 
mandate  on  the  airlines,  the  aircraft  manufacturer 
and  the  flying  public  was  high  and  resulted  in 
numerous  complaints  to  the  regulatory  authorities. 
It  must  be  noted  that  since  that  time  more  than 
twelve  years  have  elapsed  without  a  single  accident 
attributable  to  WFD. 

These  instances  explain  my  motivation  for  including  the 
subject  of  safety  during  this  Lecture  Series.  However. 


the  subject  is  extensive  and  so  many  books  have 
appeared  that  address  some  aspect  or  the  other  that  my 
remarks  are  meant  to  complement  the  existing  literature. 
Much  of  what  I  intend  to  share  with  you  today  is  not 
something  I  have  developed  on  my  own,  rather  it  has 
been  influenced  by  my  comrades  and  peers  when  I  was 
in  the  civil  aviation  community. 

Scope  of  the  Lecture  -  Analysis  and  Data 
Requirements  for  Assessment  of  Operational  Safety: 

An  aircraft  is  an  assemblage  of  complex  and  highly 
integrated  sub-systems  -  the  structure,  the  power-plant, 
the  electrical,  the  mechanical,  and  hydraulic  systems, 
the  avionics  suite,  the  human-in-the-loop  to  name  a  few. 
To  eliminate  the  risk  of  the  sub-systems  to  fail, 
individually  or  in  concert,  safety  analyses  are  routinely 
performed  by  aircraft  manufacturers.  The  manufacturer 
also  conducts  analyses  to  ascertain  the  consequence  of  a 
failed  part  to  assure  that  it  does  not  in  any  way  threaten 
the  safety  of  the  entire  system. 

Before  an  aircraft  model  enters  service,  whether  for 
military  or  civil  use,  the  design  has  to  satisfy  a  rigorous 
set  of  requirements,  which  are  governed  by  regulations. 
These  requirements  include  an  analysis  of  the 
probability  of  failure  of  each  component  and  the  hazard 
caused  by  the  failure.  This  subject,  termed  as  “Systemic 
Safety  [1],”  will  be  beyond  the  scope  of  this  lecture. 
Rather,  the  remarks  will  concentrate  on  the  operational 
phase  of  the  aircraft’s  life.  That  is  the  phase  subsequent 
to  the  aircraft  put  into  operational  use  for  the  first  time. 

However,  keep  in  mind  that  before  the  aircraft  enters  the 
fleet,  there  are  numerous  design  reviews,  ground  and 
flight  tests,  and  production  approvals  that  are  required  to 
assure  that  the  aircraft  is  safe  and  able  to  perform  as 
intended  in  the  operating  environment.  At  times,  the 
origin  of  problems  that  are  encountered  in  service  may 
be  inherent  in  the  design  or  the  manufacturing  stage  or 
due  to  construction  methods.  For  instance,  an  element  in 
the  chain  that  led  to  the  failure  of  the  commercial 
aircraft  mentioned  earlier  was  a  failed  bond.  The  failed 
bond  resulted  from  an  inadequate  bonding  process.  It 
created  stress  risers  at  the  rivets,  which  were  designed  to 
merely  serve  as  secondary  conduits  for  transferring  load. 
The  resulting  fatigue  cracks  were  aggravated  by  loss  of 
material  due  to  corrosion,  resulting  in  intrusion  of 
moisture  from  condensation  and  precipitation.  Such 
problems  that  are  encountered  in  service  must  be 
quickly  corrected  in  order  to  prevent  accidents  and  to 
maintain  battle-readiness  of  the  fleet.  An  essential 
requirement  for  quick  resolution  of  these  type  of 
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problems  is  a  technical  team  that  is  familiar  with  not 
only  the  design  features  of  the  aircraft  model  and  any 
subsequent  modifications  that  had  been  effected 
previously  but  also  the  original  design  philosophy  that 
guided  the  design.  Often,  it  is  beneficial  to  retain  some 
members  of  the  original  design  team  to  serve  in  the 
maintenance  group  in  order  to  maintain  the  necessary 
know-how. 

Measurement  of  Safety 

In  order  to  assess  safety  of  a  system  after  it  enters 
service  one  must  define  safety  and  establish  a  set  of 
metrics  (measurement  standards)  for  safety.  A  metric 
may  be  the  number  of  failures  per  one  thousand 
operations,  or  it  may  be  an  incident  rate  or  an  accident 
rate.  Such  gross  metrics  are  normally  refined  by 
dividing  the  accidents  into  categories  by  causal 
relationships.  Furthermore,  metrics  are  often  normalized 
in  terms  of  usage.  In  any  event,  the  establishment  of 
safety  metrics  has  been  subjective,  to  say  the  least,  and  a 
bit  disorganized  from  the  standpoint  of  relating  the 
accident  cause,  the  events  leading  up  to  the  accident, 
and  the  design  fix.  The  problem  is  best  illustrated 
through  Figure  1,  and  2.  Both  figures  have  been 
extracted  from  publicly  released  Boeing  Airplane 
Company  documents  [2,  3],  They  depict  the  relative  risk 
of  an  accident  as  a  function  of  the  phase  of  flight,  based 
on  historical  data.  Clearly,  if  miles  flown  is  chosen  as 
the  normalizing  factor  for  a  safety  metric,  the  metric 
chosen  ignores  the  fact  that  risks  between  destinations 
involving  multiple  flight  legs  and  the  risk  involved  for  a 
single  leg,  for  the  same  distance  traveled,  are  unequal  - 
hence,  the  metric  would  be  inappropriate.  Similarly,  in 
the  assessment  of  military  aircraft,  the  hours  of 
operation  is  usually  chosen  as  the  normalizing  factor  but 
such  a  choice  ignores  the  fact  that  the  mission  profiles 
could  be  vastly  different,  even  for  the  same  aircraft 
model  but  used  in  different  squadrons.  Thus,  the 
establishment  of  multiple  metrics  for  risk  using  the 
same  database  increases  the  opportunity  for  establishing 
a  correlation  between  data  and  risk,  thereby  making  the 
safety  management  system  more  robust. 

Accidents  and  the  Role  of  Precursors: 

It  is  generally  agreed  that  there  exist  certain  precursors 
to  each  accident  and  incident.  If  one  of  these  precursors 
is  not  recognized  and  the  underlying  condition  that  has 
caused  it  is  not  corrected  in  time,  then  it  can  graduate 
into  an  incident  or  even  an  accident.  Aircraft  are  highly 
engineered  systems,  endowed  with  redundancies  and 
fail-safe  features.  They  are  “noisy”  systems.  That  is, 
they  can  give  so  many  indications,  of  which  only  a  few 
are  precursors,  that  one  can  easily  be  lulled  into 
complacency.  Fail  safety  embraces  two  concepts.  One  is 
the  concept  that  the  first  failure  does  not  impair 
functionality  of  the  system.  The  second  is  that  the  first 
failure  must  be  obvious  to  the  extent  that  it  will,  in  all 
likelihood,  be  detected  well  before  the  onset  of 
subsequent  failures,  which  may  endanger  the  safety  of 
the  system.  Thus,  the  first  occurrence  of  a  service 


difficulty  associated  with  a  sub-system  in  an  aircraft  is  a 
prospective  precursor  of  progressive  failures  that  could 
result  in  an  incident  or  accident.  Furthermore,  multiple 
occurrences  of  service  difficulties,  especially  after 
corrective  actions  have  been  attempted,  are  indicators 
that  the  risk  of  an  incident  or  accident  is  rising.  To  take 
full  advantage  of  being  given  such  warnings,  the 
organization  responsible  for  safe  operation  of  the 
aircraft  must  systematically  collect  reports  of  service 
difficulties.  Just  as  importantly,  this  same  organization 
must  systematically  and  expeditiously  analyze  the 
reports  being  collected  to  establish  their  root  cause  of 
the  difficulty  or  difficulties  and  its  potential  for  a 
resulting  accident  or  incident.  The  analysis  must  be 
accomplished  early  in  order  to  allow  sufficient  lead-time 
for  corrective  action  to  be  taken.  Even  with  a  service 
difficulty  collection  and  analysis  system  in  place,  the 
organization  will  be  unable  to  use  it  to  reduce  or 
eliminate  incidents  and  accidents  unless  higher 
management  in  the  organization  recognizes  their  value 
and  directs  development  and  implementation  of 
corrective  action.  Clearly,  improved  safety  will  result  if 
attention  is  more  focused  on  precursors. 

Detection  of  Service  Difficulty 

A  Service  Difficulty  is  symptomatically  manifested  by 
one  of  the  following: 

Visual,  such  as  cracks,  warning  lights,  observation 
of  smoke,  etc. 

Aural,  such  as  alarms,  abnormal  sounds,  etc. 

Tactile,  such  as  excessive  vibration,  electrical 
shock,  stick  response,  etc. 

Olfactory,  such  as  fumes  from  electrical  systems  or 
oil  or  rubber,  etc. 

Response  to  transducer  devices  such  as  those  used 
for  nondestructive  inspection  of  structural 
components. 

Service  difficulties  can  manifest  themselves  during 
airworthiness  inspections  and  other  maintenance  related 
activities.  One  example  is  the  detection  of  a  structural 
fatigue  crack  in  an  area  adjacent  to  the  area  being 
inspected.  The  maintenance  program  had  no  instructions 
for  inspecting  this  cracked  area.  Had  the  service 
difficulty  report  not  been  filed  on  this  crack,  and  had  a 
single  observant  authority  representative  not  discovered 
this  difficulty  report  and  investigated  it,  further  crack 
growth  in  this  area  and  other  aircraft  might  have 
occurred  and  graduated  into  something  serious. 

It  would  be  erroneous,  however,  to  draw  a  correlation 
between  the  number  of  service  difficulty  reports 
generated  and  risk.  A  large  number  of  reports  may  mean 
that  the  operational  and  maintenance  personnel  are  alert 
and  diligent  in  reporting  discrepancies,  not  necessarily 
that  the  risk  of  failure  is  rising.  In  this  case,  it  may 
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simply  be  a  tribute  to  the  robustness  of  the  inspection 
and  maintenance  program.  Only  systematic  analysis 
performed  by  trained  and  knowledgeable  analysts  can 
correlate  the  risk  level  to  the  number  of  service 
difficulty  reporting  rates. 

Analysis  and  Data  Requirements 

There  is  a  symbiotic  relationship  between:  (a)  the 
purpose  of  safety  analysis,  (b)  the  methodology  to  be 
used  for  evaluating  safety  (or  risk),  (c)  the  data  required 
to  perform  safety  analysis,  (d)  the  confidence  to  be 
reposed  in  the  results,  (e)  and  the  burden  of  the  data 
collection  effort.  All  five  aspects  will  have  to  be 
considered  in  concert  to  devise  a  robust  system  that 
balances  system  costs  (figure  3). 

Safety  analysis  may  be  required  for  a  variety  of 
purposes.  For  instance,  to  gage  the  general  health  or 
safety  of  the  fleet  would  require  a  different  methodology 
and  could  be  accomplished  with  an  abbreviated  set  of 
data  elements  than  what  might  be  needed  for  a  forensic 
analysis  of  an  accident  or  incident.  Thus,  the  circulation 
of  a  questionnaire  among  the  various  groups  involved  in 
maintaining  safety  to  establish  the  connections  between 
analysis  methodologies  that  are  being  used  or  desired, 
and  the  respective  data  requirements  is  advocated. 

Aircraft  systems  are  becoming  more  and  more  complex, 
placing  more  sophisticated  demands  on  data  collection 
and  analysis  methods.  Also,  the  increased  attention 
being  given  to  safety  and  the  accompanying  demand  for 
data  driven  safety  programs,  makes  the  data  elements 
that  would  have  been  considered  adequate  in  the  past 
appear  as  lacking  in  precision  and  detail.  Thus,  the 
number  of  data  elements,  the  extent  of  detail  to  be 
included  in  any  gathering  effort,  and  the  configuration 
of  the  database  itself  should  be  designed  to  allow  for 
some  growth  in  data  requirements.  It  is  imperative  that 
an  organization  designing  a  service  difficulty  reporting 
system  that  mandates  the  collection  of  certain  data 
elements  simultaneously  considers  the  analysis  to  be 
conducted  of  the  collected  data.  Many  existing 
databases,  such  as  the  Service  Difficulty  Reports  being 
maintained  by  the  Federal  Aviation  Administration  have 
come  in  for  criticism  [4].  These  databases  collect  many 
pieces  of  data  that  are  not  used  or  are  redundant.  Such 
databases  are  primarily  designed  to  facilitate  the 
collection  of  data  but  with  little  or  no  attention  being 
paid  to  the  needs  of  the  analyst  to  correlate  the  data  with 
the  airworthiness  of  the  individual  aircraft  or  the  fleet. 
Hence,  it  is  advocated  that  a  safety  program  -  any  safety 
program  -  be  revisited,  perhaps  re-tuned,  every  five 
years,  both  from  the  viewpoint  of  currency  and 
adequacy. 

Avionics-related  malfunctions  may  have  serious 
implications  in  terms  of  safety  of  new  generation 
aircraft.  These  systems  are  being  given  more  authority 
over  primary  flight  control  of  the  aircraft.  Thus,  the 
reporting  of  associated  malfunctions,  defects,  and 
failures  become  more  critical  to  proactive  safety 


analysis.  Their  failures  during  any  phase  of  operation 
may  have  safety  implications.  In  any  event,  data  should 
be  collected  to  support  explicit  program  requirements. 
Terminology  such  as  “abnormal  or  emergency  actions” 
and  “endanger  the  safe  operation”  in  regulations  will  not 
provide  consistent  reporting  without  further  definition 
and  guidance. 

The  distinction  between  reliability  and  safety  is  much 
debated  in  the  context  of  data  requirements.  It  has  been 
argued  the  data  needed  for  performing  safety  analysis  is 
not  as  extensive  as  that  for  maintaining  reliability. 
However,  with  the  emergence  of  the  nearly  synonymous 
philosophies  of  Reliability-Based  Maintenance  and 
Condition-Based  Maintenance,  which  takes  the  risk  of 
failure(s)  into  account,  the  distinction  is  blurring. 

Hand-held  electronic  devices  have  eliminated  much  of 
the  paperwork  in  data  gathering.  Such  devices  make 
possible  the  gathering  of  voluminous  data  without 
making  the  data  gathering  effort  either  burdensome  or 
time  consuming.  In  fact,  the  development  of  software 
that  can  readily  depict  on  a  hand-held  device  the 
geometrical  layout  of  components  as  well  as  the  inter¬ 
connectivity  of  the  functional  units  would  make 
facilitate  acquisition  of  data  that  capture  more  details 
about  a  malfunction  or  a  failure  than  is  now  the  case. 
Electronic  entry  of  data  has  another  great  advantage, 
viz.,  it  avoids  data  corruption  due  to  transcription  errors 
and  expedites  the  addition  of  more  data  elements  to  the 
database. 

Data  Standards 

The  term  “data  quality”  can  at  once  mean  different 
things,  such  as  erroneous  data,  inconsistencies  in  the 
data,  insufficient  detail  that  has  been  captured  in  the 
data,  completeness  of  the  data  sets,  etc.  Each  of  the 
meanings  has  a  bearing  on  safety.  For  instance,  there  is 
a  wealth  of  data  about  instances  of  cracking  in  airframe 
structures  but  they  are  not  very  useful  because  of  lack  of 
precision  and  standardization.  From  the  standpoint  of 
systematic  analysis  of  large  quantities  of  data,  the  most 
important  attribute  of  a  safety  related  database  is 
consistent  reporting.  The  adoption  of  a  common 
terminology  is  one  aspect  of  consistency.  Clarity  of 
terminology  is  a  related  aspect.  A  critical  need  for  data 
that  is  stored  in  relational  databases  is  that  fields  should 
be  assigned  in  each  data  record  (report)  to  allow  for 
supplementary  comments  by  the  mechanic.  The  FA  A 
maintains  one  of  the  largest  safety  database  in  the  world, 
the  Service  Difficulty  Reporting  (SDR)  System. 
However,  because  the  SDR  is  a  relational  database,  no 
provision  has  been  made  for  supplementary  notes.  For 
instance,  the  database  does  not  allow  the  mechanic  to 
record  the  specific  location  of  a  crack,  even  if  one  is 
found  in  a  principal  structural  element.  As  a  result, 
many  users  rely  on  the  SDR  system  only  to  confirm 
critical  problems  that  have  already  been  found  or 
suspected  -  not  to  give  precursory  evidence  of  potential 
incidents  or  accidents. 
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Table  1  exemplifies  a  form  for  data  recording,  which 
would  make  possible  supplementary  notes  to  be  made 
by  the  mechanic  or  inspector.  The  form  for  reporting 
incidents  was  devised  by  an  internal  FAA  team,  of 
which  the  author  was  a  member.  The  data  requirements 
for  reporting  service  difficulty  can  be  developed  in  an 
analogous  fashion. 

In  the  military  context,  harmonization  of  data  standards 
with  our  NATO  allies  will  inevitably  result  in  more 
robust  safety  systems  for  all  concerned.  Also,  since  the 
occurrences  of  many  types  of  malfunctions  are  rare, 
harmonization  will  allow  data  to  be  shared  between 
nations  that  operate  similar  aircraft  systems  and  increase 
the  data  pool,  thereby  decreasing  uncertainty  inherent  in 
statistics-based  analysis  schemes. 

Completeness  of  data,  whether  the  entry  relates  to 
deviation,  malfunction,  or  wear  is  nearly  as  important. 
The  need  to  report  and  record  every  deviation  from  the 
norm,  even  though  the  vast  majority  of  cases  are  benign, 
cannot  be  over-emphasized.  It  is  also  essential  for  the 
analyst  (or  analysis  group)  to  promptly  acknowledge 
receipt  of  each  report  and,  once  the  analysis  of  a  report 
is  complete,  to  communicate  the  results  to  the 
maintenance  group.  Otherwise,  the  latter  group  may  lose 
faith  in  the  system. 

Data  Archival  and  Retrieval 

An  efficient  database  storage  system  has  to  take  into 
account  several  factors.  Simultaneous  access  to  multiple 
users  may  be  one  requirement.  Inclusion  of  pictures,  and 
documents  in  the  database  may  be  another.  There  are 
several  ways  to  store  and  present  data  and  several  types 
of  database  management  systems  (DBMS)  have  been 
devised  and  are  commercially  available.  In  choosing  the 
right  type  of  DBMS  it  is  important  to  consider  the 
capability  of  a  typical  user  and  the  purpose  underlying 
the  use  of  the  data.  For  safety  analyses  purposes,  the 
DBMS  should  be  capable  of  storing  and  manipulating 
complex  objects  and  data  types  efficiently.  The  most 
suitable  type  and  currently  available  DBMS  are  the  ones 
known  as  object-oriented  DBMS.  Such  relational 
databases  allow  for  computer-aided  searches  and  sorts 
that  are  simple  to  implement  ,  allowing  the  user  to 
concentrate  on  deriving  the  information  he  or  she  is 
seeking  rather  than  focusing  on  the  design  of  the 
database  extraction  tool.  On  the  other  hand,  if  one  is 
willing  to  invest  in  more  complex  search  engines,  the 
database  may  need  to  be  less  structured  and  therefore 
contain  much  more  information.  An  explanation  of  the 
various  types  of  DBMS  can  be  found  in  reference  [5]. 
Even  object-oriented  DBMS  have  their  drawbacks  and, 
thus,  the  entire  subject  deserves  research  attention. 

Analysis  Methods 

Service  difficulty  data  can  be  used  for  a  variety  of 
purposes  and  in  a  variety  of  ways.  The  common  thread 
that  runs  through  all  of  them,  however,  is  risk 
mitigation.  Obviously,  the  criticality  of  the  component 


associated  with  the  data,  the  number  of  incidences  of 
failure,  the  consequences  of  failure,  the  method(s)  used 
for  analysis,  the  confidence  band  inherent  in  the  analysis 
results,  and  the  statistical  character  of  the  occurrence  are 
inextricably  related. 

Accidents  and,  to  a  lesser  extent,  incidents  and 
malfunctions  typically  involve  a  chain  of  events.  The 
chain  may  simultaneously  involve  a  design  deficiency,  a 
defect  induced  during  the  manufacturing  process, 
improper  maintenance  or  other  human  factors.  Some 
aspects  that  are  frequently  involved  are  given  in  Table  2. 

It  has  been  argued  that,  since  many  factors  are  involved 
in  causing  an  incident  or  accident,  the  safety 
management  system  should  be  highly  centralized.  The 
author  would  argue  in  favor  of  the  opposite,  mainly 
because  the  safety  system  would  be  redundant  and, 
hence,  more  robust.  The  responsibility  for  safety  should 
be  divided  into  sub-groups,  whose  prime  responsibilities 
are  related  to  maintenance  or  air  traffic  control  or  some 
other  factor  identified  in  the  table.  Each  group  should  be 
persuaded  to  believe  that  they  are  ultimately  responsible 
for  safety  and  each  group  should  be  allowed  to  devise 
their  own  system  for  monitoring  risk.  Of  course,  each 
such  group  will  be  much  better  versed  in  their  own 
specialty  and  might  tend  to  give  greater  attention  to  it. 
On  the  other  hand,  it  can  be  argued  that  they  will  tend  to 
take  less  for  granted  in  other  specialty  areas  and 
therefore  subject  them  to  greater  scrutiny. 

If  the  aforementioned  view  is  accepted,  it  would  follow 
that  each  group  will  have  different  data  requirements. 
The  latter  can  be  fulfilled  with  relative  ease  by 
customizing  data,  but  which  is  drawn  from  the  same 
master  data  pool. 

One  example  of  an  extensive  and  well-disciplined 
service  difficulty  reporting  and  collection  system,  as  has 
been  previously  mentioned,  is  that  being  maintained  by 
the  FAA.  Unfortunately,  the  FAA  does  not  have  the 
means  to  systematically  analyze  the  data  reported, 
which  purportedly  is  not  all-inclusive.  Instead,  it  does  so 
in  an  ad-hoc  manner.  That  is,  it  researches  the  database 
to  seek  service  difficulties  that  indicate  the 
pervasiveness  of  a  fault  in  the  aircraft  fleet.  Such 
searches  are  carried  out  after  the  problem  has  been 
brought  to  the  attention  of  the  authority  through  other 
means,  such  as  an  incident  or  an  accident.  However,  the 
efforts  of  the  FAA  are  a  valuable  adjunct  to  the  safety 
analysis  efforts  by  industry.  Moreover,  the  SDR 
database  is  accessible  to  other  users,  such  as  aircraft 
manufacturers  and  operators,  who,  because  of  their 
focus  tend  to  be  more  systematic  in  the  analysis  of  the 
data. 

Causal  Analysis 

Causal  analysis  of  an  accident  or  incident  seeks  to 
establish  those  factors  that  were  judged  to  be  directly 
responsible  in  causing  the  event  (primary  causal  factors) 
and  those  that  contributed  to  the  event  (secondary  causal 


factors)  by  deconstructing  the  accident.  For  these  causal 
factors,  a  causal  chain  can  usually  be  established  for 
each  accident  or  incident  [6].  The  advantage  of  causal 
chain  analysis  is  that  in  the  case  of  multiple  causes  and 
multiple  accidents  or  incidents,  the  common  events  or 
elements  in  the  chain  can  be  identified  and  subjected  to 
greatest  attention.  Thus,  the  safety  system  can 
concentrate  on  those  common  events  and  maximize  its 
responsiveness  and  effectiveness  in  for  cutting  down¬ 
times,  and  reducing  or  eliminating  accidents.  The 
perceived  disadvantage  of  this  approach  is  that  it  is 
reactive  rather  than  proactive.  That  is,  the  regulating 
authority  and  the  industry  (or  the  military  operators) 
seek  to  eliminate  the  causal  factor  after  the  accident  in 
order  to  prevent  accidents  due  to  the  same  cause  from 
happening  again. 

Causal  analysis  does  have  an  advantage  over  simulation 
and  technical  conjecture  in  that  it  is  based  on  factual 
data  rather  than  models  that  mimic  a  hypothetical  event 
or  engineering  judgement,  which  relies  on  the 
knowledge  base  and  experience  of  the  technical  team. 
Moreover,  as  has  already  been  mentioned,  in  today’s 
aviation  industry,  it  is  difficult  to  retain  an  engineering 
team  that  is  intimately  familiar  with  the  continuous 
changes  in  the  aircraft  design  after  production  begins. 

The  causal  analysis  approach,  however,  also  suffers 
from  the  disadvantage  that  the  analysis  has  a  good 
measure  of  subjectivity,  both  in  regard  to  the  list  of 
factors  and  their  relative  contributions.  Also,  due  to  the 
inter-dependencies  of  the  various  factors,  such  as  those 
listed  in  Table  2,  that  are  frequently  encountered,  the 
relative  weights  ascribed  to  the  various  causal  factors 
can  vary  a  great  deal,  as  a  function  of  the  analyst.  Thus, 
an  intimate  knowledge  of  the  aircraft  system  is  a 
prerequisite  for  someone  engaging  in  causal  analysis. 
The  challenge  of  managing  aircraft  safety  is  identify  and 
focus  on  truly  hazardous  conditions,  so  they  can  be 
eliminated  before  a  potential  accident  becomes  a  reality. 

Trend  Analysis 

One  simple  and  effective  method  is  used  in  the  Aviation 
Safety  for  Accident  Prevention  (ASAP)  program  that  is 
used  by  the  FAA’s  Rotorcraft  Directorate  in  Ft.  Worth, 
Texas.  The  program  selects  components  that  fail  by  part 
numbers.  For  each  part,  it  reviews  the  service  history  for 
3,  6,  12  or  24  months  periods.  Based  on  the  counts  of 
service  difficulty  reports  involving  the  part  number,  it 
predicts  trends. 

A  risk  level  is  assigned  to  each  report.  ASAP  has  the 
ability  to  quickly  research  whether  an  accident  had  a 
service  difficulty  history.  For  example,  responding  to  a 
fatal  accident  involving  the  tail  rotor  driveshaft,  the 
analyst  was  able  to  track  part  numbers,  and  identify  five 
service  difficulty  reports  that  had  found  the  part  to  have 
been  worn  beyond  limits,  and  contained  cracks  or 
corrosion.  Two  of  the  reports  described  the  results  of 
inspection  to  be  a  sheared  tail  rotor  driveshaft.  Based  on 
the  accident  and  the  supporting  trend  indicated  by  the 


service  history,  the  Authority  issued  an  Airworthiness 
Directive  (AD).  A  year  after  the  issuance  of  the  AD 
there  were  no  more  service  difficulty  reports,  citing  that 
particular  part  was  reported.  But,  more  importantly,  the 
incidence  of  sheared  rotor  drive  shafts  has  been 
drastically  reduced.  However,  ASAP  has  one  drawback: 
usage  of  ASAP  is  not  yet  proactive  in  that  the  analyst 
must  be  prompted  by  an  event,  such  as  an  accident  or 
incident  to  conduct  trend  analysis  on  a  given  part  or 
component. 

Monitoring  of  Safety  Through  Performance 
Indicators 

The  FAA’s  Flight  Standards  Service  has  developed  a 
heuristic-based  system  called  Safety  Performance 
Analysis  System  (SPAS),  primarily  for  the  benefit  of 
their  corps  of  safety  inspectors.  They  started  building 
the  system  by  getting  teams  of  highly  experienced  and 
proficient  inspectors  together,  with  each  inspector 
identifying  the  parameters  that  he  or  she  uses  during 
surveillance  of  an  operator  or  a  repair  station  facility. 
Each  team  discussed  each  of  the  identified  parameters 
and  developed  a  consensus  about  the  relative 
importance  of  the  parameters  that  must  be  scrutinized. 
Next,  the  parameters  were  weighted  according  to  their 
perceived  importance  and  aggregated  into  groups,  with 
each  group  being  termed  as  an  “indicator.”  The 
advantage  of  a  system  that  is  based  on  indicators  is  that 
pools  the  knowledge  and  experience  of  the  “gray 
beards”  or  the  more  experienced  inspectors  in  the 
regulating  Authority  for  use  by  the  younger,  less- 
experienced  inspectors.  Hence,  it  focuses  attention  on 
what  is  a  warning  rather  than  on  events  that  are  merely 
“noises.”  The  disadvantage  is  that  a  rational  derivation 
of  threshold  values,  which  signal  caution  or  even 
danger,  is  not  possible. 

A  variation  of  the  idea  of  performance  indicators  as 
measures  of  safety  is  proposed  by  the  author.  It  is  based 
on  “wiring  diagrams”  of  sub-systems  being  used  in 
conjunction  with  the  concept  of  indicators.  In  the 
pristine  condition,  every  cell  in  the  wiring  diagram 
would  be  colored  white.  When  a  failure  of  a  certain  part 
occurs,  the  analyst  assesses  the  criticality  of  the  part  to 
flight  safety  and  assigns  a  hue  to  that  part  (cell)  in  the 
wiring  diagram.  A  deeper  hue  or  color  would  signify 
that  the  part  has  a  relatively  high  criticality.  The  wiring 
diagram  is  constantly  updated  by  adding  more  color  to 
the  particular  part  to  reflect  arrival  of  new  service 
difficulty  reports.  Two  events  will  attract  the  attention 
of  the  analyst.  The  first  is  the  depth  of  the  hue  of  a 
certain  cell  and  the  second  is  the  contiguity  of  cells  (the 
ones  that  are  sequentially  tied  or  represent  the  redundant 
feature),  in  terms  of  their  function,  that  are  hued.  The 
idea  is  based  on  the  recognition  of  the  fact  that  in  both 
cases  the  risk  of  sub-system  failure  is  increasing,  and 
that  the  wiring  diagram  pictorially  represents  the  rise.  In 
fact,  it  would  be  relatively  easy  to  convert  the  logic  into 
a  computer  code  that  automatically  raises  a  flag  in  either 
case,  which  cannot  escape  the  attention  of  the  analyst. 
Also,  different  colored  flags  may  be  set  up  to  indicate 
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the  level  of  alert.  The  scheme  will  also  need  to  take  into 
account  replacement  or  re-design  of  the  part,  or  the  sub- 
assembly  itself.  That  is  also  easily  done  by  washing  out 
the  color  in  the  particular  cell  representing  the  part  or  in 
the  block  of  cells  if  the  sub-assembly  has  been 
redesigned  or  refurbished 

Probabilistic  Risk  Analysis 

Several  probabilistic  approaches  to  safety  have  been 
proposed  [7 } .  However,  such  approaches  are  not  looked 
upon  with  enthusiasm  because  no  one  wants  to  look 
upon  safety  management  in  a  manner  that  resembles  a 
game  of  chance.  However,  there  are  at  least  two  major 
advantages  of  a  probabilistic  approach.  First,  it  takes 
into  account  the  variability  in  the  data  as  well  as  the 
trends  in  the  number  of  occurrences.  It  also  provides  for 
considering  the  relationship  between  seemingly 
unrelated  occurrences.  The  analyst  must  examine  the 
estimated  probability  of  an  accident,  given  a  high 
probability  of  the  occurrence  of  service  events,  and 
determine  if  intervention  is  required.  A  unique 
advantage  of  the  probabilistic  approach  over  a 
deterministic  approach  is  that  it  enables  the  Authority  or 
the  SafetyOffice  in  the  military  to  focus  on  the  most 
likely  causes  of  hypothetical,  future  accidents,  and 
prevent  them.  By  far  the  most  important  advantage  is 
that  it  enables  the  Authority,  and  the  operators,  to  get 
ahead  of  the  power  curve  -  that  is,  to  correct  the 
condition  before  the  first  accident  occurs. 

Concluding  Remarks 

As  new  technology  is  inducted,  aircraft  systems  will 
inevitably  become  more  complex.  New  technology 
generally  means  better  performance  and  lower  costs  but 
there  might  be  safety-related  challenges  as  well.  Also, 
increased  usage  and  operating  missions  beyond  what 
was  envisaged  in  the  design  stage  will  magnify  the 
accident  rate  as  well  as  the  fatalities,  injuries,  or  losses 
of  high-value  assets.  Safety  systems  will  need  to  be 
more  sophisticated  and  better  methods  of  analysis  will 
need  to  be  employed.  Authorities,  and  in  the  case  of  the 
military  -  themselves,  will  need  to  focus  more  on 
preventing  accidents  due  to  service  related  events  rather 
than  using  service  data  to  confirm  the  analysis  of 
accidents  that  have  already  happened. 


Concomitantly,  more  extensive  data  require-ments  and 
data  archival  systems  will  need  to  be  engineered.  Thus, 
the  cost  of  maintaining  a  high  level  of  safety  is  bound  to 
rise  but  the  cost  due  to  not  having  an  effective  system 
will  be  many  times  greater.  Safety  of  highly  engineered 
systems,  like  aircraft,  has  a  high  price  tag  but  the 
alternative  will  prove  to  be  much,  much  more 
expensive. 
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BATCH  # . 


TABLE  1:  EXAMPLE  OF  A  FORM  FOR  RECORDING  AN  INCIDENT 

_  I.D.  # _ 


REV.  DATE 


ANALYST 


0 

1 

2 

3 


_/ _ /_ 

J _ /_ 

_/ _ /_ 

_/ _ /_ 


REVIEWER 


EVENT  ID  NUMBER: 
YY  MM  DD  SE 


EVENT  CLASSIFICATION: 

HAZARDOUS _ 

MAJOR _ 

MINOR _ 

DAMAGE _ 


TIME  OF  EVENT:  (SELECT  ONE) 

UNKNOWN  _ 

UT  _ 

LOCAL  TIME  _ 

LOCATION: 

DEPARTURE  AIRPORT _ 

DESTINATION  AIRPORT _ 

EVENT  LOC.  (CITY)  _ 

COUNTRY  (EVENT)  _ 

LAT/LONG _ 

UNKNOWN _ 


AIRCRAFT: 
TYPE-SERIES. 
A/C  MAKE _ 


FUSELAGE  NO. _ 

DATE  MANUFACTURED . 

TAIL  NUMBER _ 

SERIAL  NUMBER _ 

ENGINE  MAKE _ 


ENGINE  MODEL(S) _ 

ENGINE  SERIAL  NO(S). . 
FLIGHT  NUMBER _ 


TYPE  OF  MISSION:  (SELECT  UP  TO  2) 
SCHEDULED  PAX  CARGO 

UNSCHEDULED  PAX  FERRY 

FLIGHT  TEST  TRAINING 

UNKNOWN 
MAINT 

AIRLINE/OPERATOR: 

OPERATOR  NAME _ 


OPERATOR  OAG  CODE . 


METEOROLOGICAL/ENVIRONMENT  CONDITIONS: 

IMC/VMC _  VERTICAL  TURBULENCE. 

CLOUD  CEILING  FT  OR  M _  HAZE _ _ 

LIGHT  CONDITIONS  HAIL _ 

DAY/NIGHT/DUSK/DAWN _ 

VISIBILITY  FT,  M,  MI _ 

WIND:  DIRECTION _ 

VELOCITY  IN  KTS _ 


TEMPERATURE  F  OR  C 

MICROBURST _ 

CAT  _ 


BIRDS _ 

SNOW/SLUSH. 

SAND/ASH _ 

THUN  STRMS_ 
LIGHTNING  _ 


OTHER  WEATHER _ 

ICE/RAIN/FOG/GUSTS 


WINDSHEAR. 


BOARDING 
CARGO  LOADING 
ENGINE  START 
TAXI 

TAKE  OFF 
ROLL 
ROTATION 
INIT  CLIMB 
GO  AROUND 
DURING  DIVERT 


PHASE  OF  OPERATION 
DESCENT 
APPROACH 
INITIAL 
FINAL 
LANDING 

FLARE  &  TOUCHDOWN 
ROLL 

TOUCH  AND  GO 
CRUISE 


DEBOARDING 

PARKED 

REFUELING 

INSPECTION 

TOWED 

SERVICING 

UNKNOWN 

CLIMB  TO  CRUIS 

TAXI 
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HARDWARE  INVOLVED  IN  INCIDENT:  ATA  CODE  /  / 

NAME  _ 

_  _  MODEL  _ 

_  _  MAKE  _ 

_  _  LOCATION _ 

_  _  PART  NUMBER _ 

_  _  TOTAL  TIME _ 

TIME  SINCE  O/H _ 

CYCLES  SINCE  O/H 
TOTAL  CYCLES _ 

TYPE  OF  HUMAN  MACHINE  INTERFACE  ERROR 
Suggest  that  a  coded  list  be  developed  that  is  similar  to  ATA  codes 


NAT.  AVIATION  SYSTEM  (NAS):  TBD 

FLIGHT  CREW  EXPERIENCE: 

CAPTAIN _ _ 

TIME  IN  TYPE  ACFT _ 

FIRST  OFFICER 

TIME  IN  TYPE  ACFT _ 

SECOND  OFFICER 

TIME  IN  TYPE  ACFT _ 

DATA  SOURCES: 

FLIGHT  CREW _ 

MAINTENANCE _ 

OPERATOR _ 

MANUFACTURER _ 

NTSB _ 

WAAS _ 


PILOT  IN  COMMAND 
TOTAL  FLYING  TIME 

TOTAL  FLYING  TIME 

TOTAL  FLYING  TIME 


ATC _ 

CAA _ 

FLT  INT _ 

FLIGHT  SAFETY  FOUNDATION 

NEWS _ 

AIRCLAIMS _ 

OTHER _ 


BRIEF  DESCRIPTION:  _ 

Describe  the  event/situation.  Keeping  in  mind  the  following  topics,  discuss  those  which  you  feel  are  relevant  and 
anything  else  you  think  is  important.  Include  what  you  believe  really  caused  the  problem,  and  what  can  be  done  to 
prevent  a  recurrence,  or  correct  the  situation.  (USE  ADDITIONAL  PAGES  IF  NECESSARY) 


1.  CHAIN  OF  EVENTS 
How  the  problem  arose 
Contributing  factors 
How  was  it  discovered 
Corrective  actions  taken 
System  configurations  and 
operating  modes 
What  procedures  were  used 
How  did  you  decide  what  to  do 
What  stopped  the  incident  from 
becoming  an  accident 
Failure  in  Cockpit  Resource 
Management  Fatigue 


FULL  NARRATIVE: 


2.  HUMAN  PERFORMANCE  CONSIDERATIONS 
Perceptions,  judgements,  decisions 
Factors  affecting  the  quality  of  human  performance 
Actions  or  inactions 
Lack  of  positional  awareness 
Lack  of  awareness  of  circumstances 
of  flight 

Incorrect  selection  on  instrument/navaid 

Action  on  wrong  control/instrument 

Slow/delayed  action 

Omission  of  action/inappropriate  action 

Fatigue 

State  of  mind 

Lack  of  qualification/training/experience 
Incapacitation/medical  or  other  factors 
reducing  crew  performance 
Deliberate  non-adherence  to  procedures 


ANALYST  COMMENTS:  _ 

Factors  Relevant  to  Incident 

(Each  incident  usually  has  more  than  one  factor) 
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Group 


Factor 


No.  acc. 


A. _ Causal  factors 

A.  1  Aircraft  systems 


A.2  ATC/Ground  aids 


A. 3  Environmental 


A.4  Crew 


A.5  Engine 


A.6  Fire 


A.7  Maintenance/ 
ground  handling 


1.1  System  failure  -  affecting  controllability 

1 .2  System  failure  -  flight  deck  information 

1 .3  System  failure  -  other _ 

2.1  Incorrect  or  inadequate  instruction/advice 

2.2  Misunderstood/missed  communication 

2.3  Failure  to  provide  separation  -  air 

2.4  Failure  to  provide  separation  -  ground 

2.5  Ground  aid  malfunction  or  unavailability _ 

3.1  Structural  overload 

3.2  Wind  shear/upset/turbulence 

3.3  Icing 

3.4  Wake  turbulence  -  aircraft  spacing 

3.5  Volcanic  ash/sand/precipitation  etc. 

3.6  Birds 

3.7  Lightning 

3.8  Runway  condition  unknown  to  crew _ 

4. 1  Lack  of  positional  awareness  -  in  air 

4.2  Lack  of  positional  awareness  -  on  ground 

4.3  Lack  of  awareness  of  circumstances  in  flight 

4.4  Incorrect  selection  on  instrument/navaid 

4.5  Action  on  wrong  control/instrument 

4.6  Slow/delayed  action 

4.7  Omission  of  action/inappropriate  action 

4.8  “Press-on-Us” 

4.-9  Failure  in  CRM  (cross-check/co-ordinate) 

4. 10  Poor  professional  judgments/airmanship 

4.11  Disorientation 

4.12  Fatigue 

4.13  State  of  mind 

4.14  Interaction  with  automation 

4. 1 5  Fast  and/or  high  on  approach 

4.16  Slow  and/or  low  on  approach 

4.17  Loading  incorrect 

4.18  Flight  handling 

4.19  Lack  of  qualification/training/experience 

4.20  Incapacitation/medical  or  other  factors  reducing  crew 

performance 

4.21  Failure  in  look-out 

4.22  Deliberate  non-adherence  to  procedures _ 

5.1  Engine  failure 

5.2  Propeller  failure 

5.3  Damage  due  to  non-containment 

5.4  Fuel  contamination 

5.5  Engine  failure  simulated _ 

6.1  Engine  fire  or  overheat 

6.2  Fire  due  to  aircraft  systems 

6.3  Fire  -  other  cause 

6.4  Post  crash  fire _ 

7.1  Failure  to  complete  due  maintenance 

7.2  Maintenance  or  repair  error/oversight/inadequacy 

7.3  Ground  staff  struck  by  aircraft 

7.4  Loading  error 

7.5  SUPS  -  Suspected  Unapproved  Parts 

7.6  Unapproved  Parts _ 
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Group  Factor  No.  acc. 


A. _ Causal  factors 


A.  8  Structure 

8. 1  Corrosion/fatigue 

8.2  Overload  failure 

8.3  Flutter 

A.9  Infrastructure 

9.1  Incorrect,  inadequate  or  misleading  information  to  crew 

9.2  Inadequate  airport  support 

A.  10  Design 

1 0. 1  Design  shortcomings 

10.2  Unapproved  modification 

10.3  Manufacturing  defect 

A.  11  Performance 

11.1  Unable  to  maintain  speed/height 

1 1.2  Aircraft  becomes  uncontrollable 

A.  12  Other 

12. 1  Caused  by  other  aircraft 

12.2  Non-adherence  to  cabin  safety  procedures 

B. _ Circumstantial  factors 


B .  1  Aircraft  systems 

1.1  Non-fitment  of  presently  available  safety  equipment 
(GPWS,  TCAS,  windshear  warning,  etc.) 

1.2  Failure/inadequacy  of  safety  equipment 

B.2  ATC/ground  aids 

2.1  Lack  of  ATC 

2.2  Lack  of  ground  aids 

B.3  Environmental 

3.1  Poor  visibility 

3.2  Other  weather 

3.3  Runaway  condition  (ice,  slippery,  standing  water,  etc.) 

B.4  Training 

4.1  Training  inadequate 

4.2  Presented  with  situation  beyond  training 

4.3  Failure  in  CRM  (cross-check/co-ordinate) 

B.5  Infrastructure 

5 . 1  Incorrect/inadequate  procedures 

5.2  Company  management  failure 

5.3  Inadequate  regulation 

5.4  Inadequate  regulatory  oversight 

C. _ Consequences _ 

C.  1  Controlled  flight  Into  Terrain  (CFIT) 

C.2  Collision  with  terrain/water/obstacle 

C.3  Mid-air  collision 

C.4  Ground  collision  with  other  aircraft 

C.5  Ground  collision  with  object/obstacle 

C.6  Loss  of  control  in  flight 

C.7  Fuel  exhaustion 

C.8  Overrun 

C.9  Undershoot 

C.10  Structural  failure 

C.l  1  Post  crash  fire 

C.  1 2  Fire/smoke  during  operation 

C.  1 3  Emergency  evacuation  difficulties 

C.l 4  Forced  landing  -  land  or  water 

C.  1 5  Other  cause  of  fatality _ 


D.  Unknown 

Level  of  confidence  _  High  _  Medium  ______  Low  _ Insufficient 

Information 


Note:  Acts  of  terrorism  and  sabotage,  test  and  military-type  operations,  and  fatalities  to  third  parties  not  caused  by  the 
aircraft  or  its  operation  are  excluded. 


TABLE  2:  ASPECTS  THAT  CAN  ADVERSELY  AFFECT  SAFETY 


Design 

New  Technology 
Repair 

Flight  Operations 

Software 

Regulations 

Hazardous  Cargo/Stores 


Manufacturing 
Technological  Obsolescence 
Unwitting  Exceedances 
Air  Traffic  Control 
Training 

Environmental  Rules 


Maintenance 
Human  Factors 
Configuration  Management 
Adverse  Environment 
Records 

Unapproved  Parts 


Figure  1 


Accidents  and  Onboard  Fatalities  by  Phase  of  Flight 

Hull  Loss  and/or  Fatal  Accidents  —  Worldwide  Commercial  Jet  Fleet  —  1988  through  1997 


Percentage  of  accidents/fatalHies 


Final 

approach  Landing 


initial 
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Climb 
(flaps  up) 


Takeoff 


Cruise' 


Exposure,  percentage  of  flight  time 
based  on  flight  duration  of  1,5  hours 


initial 
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Distribution  of  accidents  and  fatalities 

1.499 
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approach  approach 


Landing 


Taxi,  load.  Takeoff  Initial  Climb 

parked  climb 


Cruise' 


<0.5%. 

Cruise  includes  4  accidents  (84  fatalities)  with  unknown  flight  phase. 


Fatalities 


Hull  loss  and/or  fatal  accidents 


dieted 
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Figure  2. 


Figure  3.  Elements  Associated  With  Service  Difficulty  Related  Activities 
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